[hobbit] Re: New to Hobbit --- file monitoring

Fri Nov 2 01:57:21 CET 2007

check your ghosts report to see if foo.bar.com is reporting in as foo.

And when are you going to change GREEN to "COLOR=green"?

GLH

________________________________

	From: Josh Luthman [mailto:josh at imaginenetworksllc.com] 
	Sent: Thursday, November 01, 2007 5:13 PM
	To: hobbit at hswn.dk
	Subject: Re: [hobbit] Re: New to Hobbit --- file monitoring

	I'm basing my changes on Greg.  These still do not work, though
I believe they're a step towards the right direction:

	#hobbit-clients.cfg
	HOST=foo.bar.com
	  FILE "/etc/passwd" GREEN NOEXIST TRACK 

	#client-local.cfg
	[foo.bar.com]
	file:/etc/passwd

	I do notice that on my main machine running the server and
client that there is Client Data available if you click on the Files
test.  There is no client data from the foo.bar.com files test, however.
I think my problem right now is that I'm not getting the data from
foo.bar.com to BBD.  Any ideas at this point?

	On 11/1/07, Hubbard, Greg L <greg.hubbard at eds.com> wrote: 

		Here is something I use that works.  This is a "bookend"
problem -- both parts have to be done correctly.  Hobbit tends to
silently ignore errors in configuration files.

		---------------------------------------------------

		In client-local.cfg

		[myserver.mydomain.com]
		file:/opt2/log/syslog.log 
		file:/opt2/log/security.log
		file:/opt2/log/snmptrap.log

		---------------------------------------------------

		in hobbit-clients.cfg

		HOST=myserver.mydomain.com
		        FILE /opt2/log/syslog.log mtime<600 size<2G
TRACK
		        FILE /opt2/log/security.log TRACK
		        FILE /opt2/log/snmptrap.log mtime<600 size<2G
TRACK

		----------------------------------------------------

		Some things to note

		a) the host names match exactly, and they are not
enclosed in double quotes.

		b) the file names match exactly

		c) this example is lifted from my running system, with
the host name changed to protect the guilty.  I have some other examples
that use color in the "COLOR=color" format, which I believe is required,
but I would have to edit them more before I can post them.

		d) the client-local.cfg file has some predefined
sections in it.  Don't use them.  Make new ones.  Only one section can
be applied to a host, so cut and paste will
		be your friend.

________________________________

			From: Scott Mohnkern [mailto:mohnkern at gmail.com]

			Sent: Thursday, November 01, 2007 4:00 PM 

			To: hobbit at hswn.dk 
			Subject: Re: [hobbit] Re: New to Hobbit --- file
monitoring

			Nope, no joy there either.  the man page seems
to think it should be:

			FILE <full path to file><color> <condition>

			and that's pretty consistent with the other
things I've put into the same file, which come up. 

			I also tried:

			FILE "/etc/passwd" green noexist TRACK

			and 

			FILE "/etc/passwd" green noexist

			Scott

			On 11/1/07, Hubbard, Greg L
<greg.hubbard at eds.com> wrote: 

				Try this

				FILE /etc/passwd noexist COLOR=green
TRACK

________________________________

				From: Scott Mohnkern
[mailto:mohnkern at gmail.com] 
				Sent: Thursday, November 01, 2007 3:39
PM
				To: hobbit at hswn.dk
				Subject: Re: [hobbit] Re: New to Hobbit
--- file monitoring

				Well, at least its replicatable.

				Scott

				On 11/1/07, Scott Mohnkern <
mohnkern at gmail.com <mailto:mohnkern at gmail.com> > wrote: 

				Thanks for the help.  I edited
/etc/hobbit/hobbit-clients.cfg so the line reads:

				FILE /etc/passwd GREEN noexist

				still no joy.  

				Is there anyone on the list that has an
example of a FILE line in their hobbit-clients.cfg file?

				On 11/1/07, Hubbard, Greg L <
greg.hubbard at eds.com <mailto:greg.hubbard at eds.com> > wrote: 

				Try removing the TRACK keyword, and then
change NOEXIST to lower case.  I think Henrik has reported that there
are a few bugs in this code, 
				and it is not always clear when case
matters and when it doesn't, or when the order of the arguments matters.

________________________________

				From: Scott Mohnkern
[mailto:mohnkern at gmail.com] 
				Sent: Thursday, November 01, 2007 3:10
PM
				To: hobbit at hswn.dk
				Subject: [hobbit] Re: New to Hobbit ---
file monitoring

				When all else fails, nuke it and start
over.  I did an apt-get remove hobbit, and then a dpkg -- purge.  Then I
removed any files I could find.  Then I downloaded the Ubuntu deb file
and installed it.  It put the configuration files in /etc/hobbit and it
started fine 

				I edited /etc/hobbit/hobbit-clients.cfg
and added the following line:

				PROC ntpd 1 99 green "TEXT=NTPD is up"

				Restarted hobbit, and in a few minutes,
it started reporting as expected.

				Then I added:

				PORT "LOCAL=%(:8888)" TEXT="Gnump is up"

				To the same file,
(/etc/hobbit/hobbit-clients.cfg) and restared hobbit.

				A few minutes later, the ports section
started reporting, as expected. 

				(Though I realize that its a bit off,
which I need to fix)

				Then I added:

				FILE /etc/passwd GREEN NOEXIST track

				Reading the documentation inside
hobbit-clients.cfg I edited /etc/hobbit/client- local.cfg and added the
following line:
				file:/etc/passwd

				restarted hobbit, waited 5 minutes.  No
luck.

				I'm pretty convinced that either:

				1. the format of the line  in
/etc/hobbit/client-local.cfg or /etc/hobbit/hobbit-clients.cfg is
incorrect, or
				2. There's something else I need to
edit.

	-- 
	Josh Luthman
	Office: 937-552-2340
	Direct: 937-552-2343
	1100 Wayne St
	Suite 1337
	Troy, OH 45373

	Those who don't understand UNIX are condemned to reinvent it,
poorly. 
	--- Henry Spencer 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20071101/56b3cdd4/attachment.html>