Ghost reports doesn't have foo.bar.com but it does have something else - an old hostname that I changed a while back, can you tell me how to fix this?
Greg - making that change didn't fix it. I still have "no files checked" =(
Josh
On 11/1/07, Hubbard, Greg L <greg.hubbard at eds.com> wrote:
check your ghosts report to see if foo.bar.com is reporting in as foo.
And when are you going to change GREEN to "COLOR=green"?
GLH
*From:* Josh Luthman [mailto:josh at imaginenetworksllc.com] *Sent:* Thursday, November 01, 2007 5:13 PM *To:* hobbit at hswn.dk *Subject:* Re: [hobbit] Re: New to Hobbit --- file monitoring
I'm basing my changes on Greg. These still do not work, though I believe they're a step towards the right direction:
#hobbit-clients.cfg HOST=foo.bar.com FILE "/etc/passwd" GREEN NOEXIST TRACK
#client-local.cfg [foo.bar.com] file:/etc/passwd
I do notice that on my main machine running the server and client that there is Client Data available if you click on the Files test. There is no client data from the foo.bar.com files test, however. I think my problem right now is that I'm not getting the data from foo.bar.com to BBD. Any ideas at this point?
On 11/1/07, Hubbard, Greg L <greg.hubbard at eds.com> wrote:
Here is something I use that works. This is a "bookend" problem -- both parts have to be done correctly. Hobbit tends to silently ignore errors in configuration files.
In client-local.cfg
[myserver.mydomain.com] file:/opt2/log/syslog.log file:/opt2/log/security.log file:/opt2/log/snmptrap.log
in hobbit-clients.cfg
HOST=myserver.mydomain.com FILE /opt2/log/syslog.log mtime<600 size<2G TRACK FILE /opt2/log/security.log TRACK FILE /opt2/log/snmptrap.log mtime<600 size<2G TRACK
Some things to note
a) the host names match exactly, and they are not enclosed in double quotes.
b) the file names match exactly
c) this example is lifted from my running system, with the host name changed to protect the guilty. I have some other examples that use color in the "COLOR=color" format, which I believe is required, but I would have to edit them more before I can post them.
d) the client-local.cfg file has some predefined sections in it. Don't use them. Make new ones. Only one section can be applied to a host, so cut and paste will be your friend.
*From:* Scott Mohnkern [mailto:mohnkern at gmail.com] *Sent:* Thursday, November 01, 2007 4:00 PM *To:* hobbit at hswn.dk *Subject:* Re: [hobbit] Re: New to Hobbit --- file monitoring
Nope, no joy there either. the man page seems to think it should be:
FILE <full path to file><color> <condition>
and that's pretty consistent with the other things I've put into the same file, which come up.
I also tried:
FILE "/etc/passwd" green noexist TRACK
and
FILE "/etc/passwd" green noexist
Scott
On 11/1/07, Hubbard, Greg L <greg.hubbard at eds.com> wrote:
Try this
FILE /etc/passwd noexist COLOR=green TRACK
*From:* Scott Mohnkern [mailto:mohnkern at gmail.com] *Sent:* Thursday, November 01, 2007 3:39 PM *To:* hobbit at hswn.dk *Subject:* Re: [hobbit] Re: New to Hobbit --- file monitoring
Well, at least its replicatable.
Scott
On 11/1/07, Scott Mohnkern < mohnkern at gmail.com> wrote:
Thanks for the help. I edited /etc/hobbit/hobbit-clients.cfg so the line reads:
FILE /etc/passwd GREEN noexist
still no joy.
Is there anyone on the list that has an example of a FILE line in their hobbit-clients.cfg file?
On 11/1/07, Hubbard, Greg L < greg.hubbard at eds.com> wrote:
Try removing the TRACK keyword, and then change NOEXIST to lower case. I think Henrik has reported that there are a few bugs in this code,
and it is not always clear when case matters and when it doesn't, or when the order of the arguments matters.
*From:* Scott Mohnkern [mailto:mohnkern at gmail.com] *Sent:* Thursday, November 01, 2007 3:10 PM *To:* hobbit at hswn.dk *Subject:* [hobbit] Re: New to Hobbit --- file monitoring
When all else fails, nuke it and start over. I did an apt-get remove hobbit, and then a dpkg -- purge. Then I removed any files I could find. Then I downloaded the Ubuntu deb file and installed it. It put the configuration files in /etc/hobbit and it started fine
I edited /etc/hobbit/hobbit-clients.cfg and added the following line:
PROC ntpd 1 99 green "TEXT=NTPD is up"
Restarted hobbit, and in a few minutes, it started reporting as expected.
Then I added:
PORT "LOCAL=%(:8888)" TEXT="Gnump is up"
To the same file, (/etc/hobbit/hobbit-clients.cfg) and restared hobbit.
A few minutes later, the ports section started reporting, as expected.
(Though I realize that its a bit off, which I need to fix)
Then I added:
FILE /etc/passwd GREEN NOEXIST track
Reading the documentation inside hobbit-clients.cfg I edited /etc/hobbit/client- local.cfg and added the following line: file:/etc/passwd
restarted hobbit, waited 5 minutes. No luck.
I'm pretty convinced that either:
- the format of the line in /etc/hobbit/client-local.cfg or /etc/hobbit/hobbit-clients.cfg is incorrect, or
- There's something else I need to edit.
-- Josh Luthman Office: 937-552-2340 Direct: 937-552-2343 1100 Wayne St Suite 1337 Troy, OH 45373
Those who don't understand UNIX are condemned to reinvent it, poorly. --- Henry Spencer
-- Josh Luthman Office: 937-552-2340 Direct: 937-552-2343 1100 Wayne St Suite 1337 Troy, OH 45373
Those who don't understand UNIX are condemned to reinvent it, poorly. --- Henry Spencer