Hi Bill,
you have to use:
HOST=hobbit PROC arpwatch 1 LOG /var/log/messages %arpwatch COLOR=yellow
I'm using this syntax in my Hobbit installation and it works fine.
Regards.
Massimo Morsiani Information Technology Dept.
Gilbarco S.p.a. via de' Cattani, 220/G 50145 Firenze tel: +39-055-30941 fax: +39-055-318603 email: massimo.morsiani at gilbarco.com web: http://www.gilbarco.it
-----Original Message----- From: Bill Hart [mailto:bill.hart at burkecorp.com] Sent: martedƬ 13 febbraio 2007 18.51 To: hobbit at hswn.dk Subject: [hobbit] LOG not triggering
I'm hoping this is something obvious.
My Hobbit server (4.2.0, patched on Friday) has the following entry in the hobbit-clients.cfg file :
HOST=hobbit PROC arpwatch 1 LOG /var/log/messages "arpwatch" COLOR=yellow
That is all I've changed, the default section remains the same
The PROC line works fine, but the LOG seems to be ignored.
I have entries in the messages file showing up on the hobbit server :
System logs at Tue Feb 13 11:40:27 CST 2007
No entries in /var/log/messages
Full log /var/log/messages Feb 13 11:09:07 hobbit arpwatch: bogon 0.0.0.0 Feb 13 11:25:34 hobbit arpwatch: bogon 169.254.49.204 Feb 13 11:25:36 hobbit last message repeated 2 times Feb 13 11:30:47 hobbit arpwatch: new station xx.xx.xx.xx Feb 13 11:34:51 hobbit arpwatch: new station xx.xx.xx.xx
As you can see it's not triggering on the arpwatch entries there.
I've tried arpwatch, "arpwatch:", and "arpwatch", as well as %.* in place of /var/log/messages, none of it seems to cause a yellow condition.
Anyone have any pointers on what I'm doing wrong ? The logs all look clean in /var/log/hobbit, only entries for an external script I'm running that has nothing to do with this.
Thanks, Bill Hart
Computer Support Supervisor
Burke Corporation
1516 South D Avenue
PO Box 209
Nevada, IA 50201-0209
(515) 382-3575 x8406
www.BurkeCorp.com
Always make it your best(r)
To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk
This message (including any attachments) contains confidential
and/or proprietary information intended only for the addressee.
Any unauthorized disclosure, copying, distribution or reliance on
the contents of this information is strictly prohibited and may
constitute a violation of law. If you are not the intended
recipient, please notify the sender immediately by responding to
this e-mail, and delete the message from your system. If you
have any questions about this e-mail please notify the sender
immediately.