Henrik, So far it is working beautifully! Thank you! This will help replace quite a number of instances of custom client scripts for log monitoring. Henrik Stoerner wrote:
On Wed, May 24, 2006 at 03:09:28AM +0000, David Gore wrote:
Since there has not been much response to my cries for help, here is some more info, although I do appreciate Rich S. for taking a stab at it: hobbitd_client --dump-config FILE /var/tmp/testfile1 yellow mtime>0 HOST=hobbit (line: 139)
Regardless as you can see my 'mtime' value is being lost.
OK, this is a "cut-and-paste" bug. Thanks a lot for digging into this with such persistence. Does this fix it for you?
Henrik
------------------------------------------------------------------------
--- hobbitd/client_config.c 2006/05/19 12:40:59 1.35 +++ hobbitd/client_config.c 2006/05/24 05:52:03 @@ -791,39 +792,39 @@ } else if (strncasecmp(tok, "mtime>", 6) == 0) { currule->flags |= FCHK_MTIMEMIN; - currule->rule.fcheck.minmtimedif = atol(tok+5); + currule->rule.fcheck.minmtimedif = atol(tok+6); } else if (strncasecmp(tok, "mtime<", 6) == 0) { currule->flags |= FCHK_MTIMEMAX; - currule->rule.fcheck.maxmtimedif = atol(tok+5); + currule->rule.fcheck.maxmtimedif = atol(tok+6); } else if (strncasecmp(tok, "mtime=", 6) == 0) { currule->flags |= FCHK_MTIMEEQL; - currule->rule.fcheck.mtimeeql = atol(tok+5); + currule->rule.fcheck.mtimeeql = atol(tok+6); } else if (strncasecmp(tok, "ctime>", 6) == 0) { currule->flags |= FCHK_CTIMEMIN; - currule->rule.fcheck.minctimedif = atol(tok+5); + currule->rule.fcheck.minctimedif = atol(tok+6); } else if (strncasecmp(tok, "ctime<", 6) == 0) { currule->flags |= FCHK_CTIMEMAX; - currule->rule.fcheck.maxctimedif = atol(tok+5); + currule->rule.fcheck.maxctimedif = atol(tok+6); } else if (strncasecmp(tok, "ctime=", 6) == 0) { currule->flags |= FCHK_CTIMEEQL; - currule->rule.fcheck.ctimeeql = atol(tok+5); + currule->rule.fcheck.ctimeeql = atol(tok+6); } else if (strncasecmp(tok, "atime>", 6) == 0) { currule->flags |= FCHK_ATIMEMIN; - currule->rule.fcheck.minatimedif = atol(tok+5); + currule->rule.fcheck.minatimedif = atol(tok+6); } else if (strncasecmp(tok, "atime<", 6) == 0) { currule->flags |= FCHK_ATIMEMAX; - currule->rule.fcheck.maxatimedif = atol(tok+5); + currule->rule.fcheck.maxatimedif = atol(tok+6); } else if (strncasecmp(tok, "atime=", 6) == 0) { currule->flags |= FCHK_ATIMEEQL; - currule->rule.fcheck.atimeeql = atol(tok+5); + currule->rule.fcheck.atimeeql = atol(tok+6); } else if (strncasecmp(tok, "md5=", 4) == 0) { currule->flags |= FCHK_MD5;
------------------------------------------------------------------------
To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk