[hobbit] Re: New to Hobbit --- file monitoring

[Scott Mohnkern]

That's what I was missing (and was entirely unclear in the documentation.  I
knew I had to have an entry in both files, but didn't realize that I needed
a hostname definition   in both places.

For purposes of completeness in documentation:

127,.0.0.1 and localhost do not in fact work for myserver.mydomain.name,
however, the host name (from /etc/hostname) does.

Now that I know that it's actually checking it, I just need to set the rules
on it, which should be straightforward.


Thanks!

Scott

On 11/1/07, Hubbard, Greg L <greg.hubbard at eds.com> wrote:
>
>  Here is something I use that works.  This is a "bookend" problem -- both
> parts have to be done correctly.  Hobbit tends to silently ignore errors in
> configuration files.
>
> ---------------------------------------------------
>
> In client-local.cfg
>
> [myserver.mydomain.com]
> file:/opt2/log/syslog.log
> file:/opt2/log/security.log
> file:/opt2/log/snmptrap.log
> ---------------------------------------------------
>
> in hobbit-clients.cfg
>
> HOST=myserver.mydomain.com
>         FILE /opt2/log/syslog.log mtime<600 size<2G TRACK
>         FILE /opt2/log/security.log TRACK
>         FILE /opt2/log/snmptrap.log mtime<600 size<2G TRACK
> ----------------------------------------------------
>
> Some things to note
>
> a) the host names match exactly, and they are not enclosed in double
> quotes.
>
> b) the file names match exactly
>
> c) this example is lifted from my running system, with the host name
> changed to protect the guilty.  I have some other examples that use color in
> the "COLOR=color" format, which I believe is required, but I would have to
> edit them more before I can post them.
>
> d) the client-local.cfg file has some predefined sections in it.  Don't
> use them.  Make new ones.  Only one section can be applied to a host, so cut
> and paste will
> be your friend.
>
>
>  ------------------------------
> *From:* Scott Mohnkern [mailto:mohnkern at gmail.com]
> *Sent:* Thursday, November 01, 2007 4:00 PM
> *To:* hobbit at hswn.dk
> *Subject:* Re: [hobbit] Re: New to Hobbit --- file monitoring
>
> Nope, no joy there either.  the man page seems to think it should be:
>
> FILE <full path to file><color> <condition>
>
> and that's pretty consistent with the other things I've put into the same
> file, which come up.
>
> I also tried:
>
> FILE "/etc/passwd" green noexist TRACK
>
> and
>
> FILE "/etc/passwd" green noexist
>
>
> Scott
>
>
>
> On 11/1/07, Hubbard, Greg L <greg.hubbard at eds.com> wrote:
> >
> >  Try this
> >
> > FILE /etc/passwd noexist COLOR=green TRACK
> >
> >  ------------------------------
> > *From:* Scott Mohnkern [mailto:mohnkern at gmail.com]
> > *Sent:* Thursday, November 01, 2007 3:39 PM
> > *To:* hobbit at hswn.dk
> > *Subject:* Re: [hobbit] Re: New to Hobbit --- file monitoring
> >
> >  Well, at least its replicatable.
> >
> >
> > Scott
> >
> >
> > On 11/1/07, Scott Mohnkern < mohnkern at gmail.com> wrote:
> > >
> > > Thanks for the help.  I edited /etc/hobbit/hobbit-clients.cfg so the
> > > line reads:
> > >
> > > FILE /etc/passwd GREEN noexist
> > >
> > > still no joy.
> > >
> > > Is there anyone on the list that has an example of a FILE line in
> > > their hobbit-clients.cfg file?
> > >
> > > On 11/1/07, Hubbard, Greg L < greg.hubbard at eds.com> wrote:
> > > >
> > > >
> > > > Try removing the TRACK keyword, and then change NOEXIST to lower case.  I think Henrik has reported that there are a few bugs in this code,
> > > > and it is not always clear when case matters and when it doesn't, or
> > > > when the order of the arguments matters.
> > > >
> > > >
> > > >  ------------------------------
> > > >  *From:* Scott Mohnkern [mailto:mohnkern at gmail.com]
> > > > *Sent:* Thursday, November 01, 2007 3:10 PM
> > > > *To:* hobbit at hswn.dk
> > > > *Subject:* [hobbit] Re: New to Hobbit --- file monitoring
> > > >
> > > >  When all else fails, nuke it and start over.  I did an apt-get
> > > > remove hobbit, and then a dpkg -- purge.  Then I removed any files I could
> > > > find.  Then I downloaded the Ubuntu deb file and installed it.  It put the
> > > > configuration files in /etc/hobbit and it started fine
> > > >
> > > > I edited /etc/hobbit/hobbit-clients.cfg and added the following
> > > > line:
> > > >
> > > > PROC ntpd 1 99 green "TEXT=NTPD is up"
> > > >
> > > >
> > > > Restarted hobbit, and in a few minutes, it started reporting as
> > > > expected.
> > > >
> > > > Then I added:
> > > >
> > > > PORT "LOCAL=%(:8888)" TEXT="Gnump is up"
> > > >
> > > > To the same file, (/etc/hobbit/hobbit-clients.cfg) and restared
> > > > hobbit.
> > > >
> > > > A few minutes later, the ports section started reporting, as
> > > > expected.
> > > >
> > > > (Though I realize that its a bit off, which I need to fix)
> > > >
> > > >
> > > > Then I added:
> > > >
> > > > FILE /etc/passwd GREEN NOEXIST track
> > > >
> > > > Reading the documentation inside hobbit-clients.cfg I edited
> > > > /etc/hobbit/client- local.cfg and added the following line:
> > > > file:/etc/passwd
> > > >
> > > > restarted hobbit, waited 5 minutes.  No luck.
> > > >
> > > >
> > > > I'm pretty convinced that either:
> > > >
> > > > 1. the format of the line  in /etc/hobbit/client-local.cfg or
> > > > /etc/hobbit/hobbit-clients.cfg is incorrect, or
> > > > 2. There's something else I need to edit.
> > > >
> > > >
> > >
> >
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20071101/f8c4c4d6/attachment.html>