I want to be able to differentiate in analysis.cfg between debian servers and debian containers (not being a debian familiar I don't know what the non container version would be called).
I looked at CLASS: in the hosts.cfg man page and it says that is used for log-file monitoring, however, in the analysis.cfg man page it talks about using CLASS= as a host selector.
Will it work? I haven't tried it, but will be doing so unless someone here says not to.
Specifically I want to check for PROC ntpd on regular debian servers and on redhat, but not check for it on debian containers since it can't run on them. Debian servers and redhat servers both report their class as linux so If I can override that on the containers and make it something else I think I can do what I want.
Thanks for any insight. Steve Purdue University