On Fri, May 12, 2006 at 02:21:27AM +0000, David Gore wrote:
Are there plans to support regular expressions in the client-local.cfg for hostname, log, file, ignore, and trigger?
"hostname" is not used in client-local.cfg
"log" and "file" : No, use the script-method to get those filenames (more below).
"ignore" and "trigger": The strings you put into the client-local.cfg are regular expressions.
It is not clear what support there is for regular expressions, perhaps it is already there for ignore, and trigger, but not log, file or the hostname?
Exactly.
I am not sure I can do this:
file:"mci-nornxdb0[1-6].SNMP_COMMUNITY.public.nxg21:SIG_SNMP.
date +%Y%b%d"
No, you cannot combine it like that. Use a command to generate the full filename.
But let's assume I can or even that the whole file name has to be a command in back ticks. Do you then put the exact same back ticked string in hobbit-clients.cfg?
FILE "mci-nornxdb0[1-6].SNMP_COMMUNITY.public.nxg21:SIG_SNMP.
date +%Y%b%d" mtime>900 yellow
No.
The way it works is that the client decides what the actual filenames are (the Hobbit server cannot do that, because it depends on client-side data - e.g. what's the output from a command you run on the client). So the client sends some real filenames back to the server, and those filenames are then matched against the expressions in hobbit-clients.cfg.
So in your case, client-local.cfg would be
file:/usr/local/bin/list_snmp_logs
and hobbit-clients.cfg could be
LOG %mci-nornxdb0[1-6].SNMP_COMMUNITY.public.nxg21:SIG_SNMP.*
Regards, Henrik