I set up a PORT rule to alert for SENDMAIL logins in the DEFAULT section of my hobbit-clients.cfg file. I wanted to override that rule for certain hosts to allow SENDMAIL logins. My hobbit-clients.cfg looks like this:
HOST=luxuria PORT "LOCAL=%([.:]25)$" state=ESTABLISHED min=0 max=9 color=green "TEXT=SENDMAIL logins" DEFAULT # These are the built-in defaults. UP 1h LOAD 5.0 10.0 DISK * 90 95 MEMPHYS 100 101 MEMSWAP 70 85 MEMACT 90 97 PROC cron PROC ntpd PORT "LOCAL=%([.:]23)$" state=ESTABLISHED min=0 max=0 color=red "TEXT=TELNET logins" PORT "LOCAL=%([.:]25)$" state=ESTABLISHED min=0 max=0 color=red "TEXT=SENDMAIL logins" PORT "LOCAL=%([.:]20)$" state=ESTABLISHED min=0 max=0 color=red "TEXT=FTP logins"
But I see this on the hobbit server display:
green SENDMAIL logins (found 1, req. at most 9) green TELNET logins (found 0, req. at most 0) red SENDMAIL logins (found 1, req. at most 0) green FTP logins (found 0, req. at most 0)
Does anybody know why both rules for the SENDMAIL port are being evaluated? The man page for hobbit-clients.cfg says: The entire file is evaluated from the top to bottom, and the first match found is used. So you should put the specific settings first, and the generic ones last.
-- Jay