[hobbit] LOG alert not showing yellow

[Manocchia, Robert]

I tried the following syntax:

 

  LOG   /var/log/messages          %authentication\sfailure  color=yellow

 

The messages appears as an alert but the color remains green.

 

  Is this syntax correct?

 

Robert Manocchia

UNIX System Administrator

IDEXX Laboratories

207 556-6860

EMail Robert-Manocchia at idexx.com

-----Original Message-----
From: Giovanni - Gestor Redix [mailto:giovanni at redix.com.br] 
Sent: Wednesday, June 06, 2007 8:48 AM
To: hobbit at hswn.dk
Subject: Re: [hobbit] LOG alert not showing yellow

 

Try using this syntax (changing space with \s + pcre)
        LOG     /var/log/messages       %authentication\sfailure
color=yellow



Giovanni M. Frainer - Gestor



Sello Tlabela (SD) wrote: 

Hi Manocchia,

 

It could be access rights, if you are running hobbit using the init script
it will run as user hobbit and make sure that hobbit user can read
/var/log/messages

 

Regards

 

Sello Tlabela

 

  _____  

From: Manocchia, Robert [mailto:Robert-Manocchia at IDEXX.com
<mailto:Robert-Manocchia at IDEXX.com> ] 
Sent: 05 June 2007 21:38
To: 'hobbit at hswn.dk <mailto:hobbit at hswn.dk> '
Subject: [hobbit] LOG alert not showing yellow

 

I have a small problem. I've set up monitoring of the /var/log/messages
logfile to search for the string "authentication failure" and alert with a
yellow button in the MSG column. I can see the error displayed when I click
on the button below the Msg column header but it does not turn yellow.

 

 

 Below is the entry in the clients-local.cfg file:

 

[batman]

log:/var/log/messages:10240

ignore MARK

 

This is the entry in the hobbit-clients.cfg file:

 

HOST=batman

        LOG     /var/log/messages       authentication failure  color=yellow

 

Why doesn't this give me a yellow alert.

 

 Thanks

 

Robert Manocchia

UNIX System Administrator

IDEXX Laboratories

207 556-6860

EMail Robert-Manocchia at idexx.com <mailto:Robert-Manocchia at idexx.com> 

 


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This e-mail and its contents are subject to the Telkom SA Limited
e-mail legal notice available at 
http://www.telkom.co.za/TelkomEMailLegalNotice.PDF
<http://www.telkom.co.za/TelkomEMailLegalNotice.PDF> 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20070606/5bb30d11/attachment.html>