[hobbit] monitoring logs

somestring has to be a regular expression (which i know nothing about), but %Relay works for me.

Regards Lars ----- Original Message ----- From: Johan Booysen To: hobbit at hswn.dk Sent: Friday, August 08, 2008 4:28 PM Subject: [hobbit] monitoring logs

I'm trying to get hobbit to monitor /var/log/messages for specific entries ("somestring" in my example below) on server1.

In hobbit-clients.cfg I've added (above DEFAULT):

HOST=server1

      LOG /var/log/messages somestring COLOR=red

And in client-local.cfg, I've added:

server1

log:/var/log/messages:10240

ignore MARK

My understanding is that server1 should now collect data from /var/log/messages, and the hobbit server will then, if it finds "somestring" in the log file, flag it as red in the msgs column.

I can now see the entire log for server1 on the web interface, but the msgs icon doesn't change to red.

What am I missing?

Also, does any of the defaults in client-local.cfg match RHEL5 machines, e.g.

[redhat]

log:/var/log/messages:10240

ignore MARK

or

[redhatES]

log:/var/log/messages:10240

ignore MARK

Thanks.