[hobbit] Not getting alerts for log entries on Solaris 10 Update 3 (SPARC)

Kenneth Bourn wrote:

I am having issues with getting Hobbit to report log entries from client log files. The server is getting the log data but, despite a valid string entry in the log file, no alerts are generated.

Here is an excerpt from my client-local.cfg file:

[hosta-z1] log:/var/adm/messages:10240

And a corresponding entry from the hobbit-clients.cfg file:

HOST=hosta-z1 LOG /var/adm/messages sshd COLOR=red

Have you tried this (turn off case insensitive matching):

LOG /var/adm/messages %(?-i)sshd COLOR=red

Dominique UNIL - University of Lausanne