13 Feb
2007
13 Feb
'07
9:10 p.m.
On Tue, Feb 13, 2007 at 11:50:48AM -0600, Bill Hart wrote:
HOST=hobbit PROC arpwatch 1 LOG /var/log/messages "arpwatch" COLOR=yellow
The PROC line works fine, but the LOG seems to be ignored.
My immediate thought is that this ought to work, but testing it I can see that it doesn't - there might be a bug there with the simple string matching.
However, using a regular expression does work. So your LOG entry could be written as LOG /var/log/messages %arpwatch COLOR=yellow
and you'll get the result you want.
Regards, Henrik