I haven't modified trap.pl in a very *long* time. Hmm... (I'm still using it.)
Going back over the code, I'm running hobbitdboard so I can get the validtime field for the test: "$BB $BBDISP \"hobbitdboard test=trap fields=hostname,validtime,color\" "
In case there's a host that doesn't send a trap that often, I wanted to change the color to green instead of having it go purple and generate an alert. So to get the time left for a test, I needed the hobbitdboard results. A side-effect is that the column won't appear until the device sends it's first trap.
For the problem device, is the log from SEC showing a hostname or IP address for the device sending the trap?
There may be a problem if it's sending a status message to Hobbit with an IP address instead of a hostname. I don't think trap.pl does a good job (or at all) of trying to resolve an IP address to a hostname that's in bb-hosts.
Hope that helps, Andy
-----Original Message----- From: Henrik Stoerner [mailto:henrik at hswn.dk] Sent: Monday, July 16, 2007 3:41 PM To: hobbit at hswn.dk Subject: Re: [hobbit] Hobbit not recognizing certain tests?
On Mon, Jul 16, 2007 at 12:43:55PM -0400, Eric Jacobs wrote:
The trap.pl uses hobbitboard to find all the hosts that have the "trap" test defined.
Bad idea - there's a chicken-and-egg problem here.
Columns do not appear in the hobbitdboard output until they exist, i.e. a status has been reported to Hobbit. So if *something* must report a "trap" status to Hobbit before the trap.pl script sees that it should do the "trap" thing ... well, I guess you can tell where I'm going.
Scripts that implement custom tests should use the "bbhostgrep" utility to scan the bb-hosts file for the hosts that have a specific tag defined.
There is actually another way it can be done, but it's not yet documented: You can send a "hostinfo" command to hobbitd, and it will return a pre-parsed version of the bb-hosts file - one line per hosts, with the fields delimited by '|' characters, eg: mail.hswn.dk|172.16.10.2|NET:intern|COMMENT:Internal mail server|smtp|pop3|imap
Regards, Henrik
To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk