Hi, I have an issue with FILE monitoring. I can't seem to get it to alert correctly if the file exists.
This is the relevant line from my client-local.cfg,
file:ls -l /applogs/mdmpim/dump/*.txt 2>/dev/null
and this is the relevant line from my analysis.cfg,
FILE "%/applogs/mdmpim/dump/*.txt" NOEXIST yellow
I've also tried,
FILE "%/applogs/mdmpim/dump/*.txt" yellow NOEXIST,
FILE "%/applogs/mdmpim/dump/*.txt" yellow noexist
and
FILE "%/applogs/mdmpim/dump/*.txt" yellow
None of them actually flag yellow!
All I get is
Files status at Wed Feb 3 11:57:36 GMT 2016
green -rw-rw-r-- 1 pimwas pimwas 254632 Jan 22 10:01 /applogs/mdmpim/dump/javacore.20160122.100109.30318.0006.txt
So it looks like it's recognising that the file is there but the colour change isn't happening.