I'm hoping this is something obvious.
My Hobbit server (4.2.0, patched on Friday) has the following entry in the hobbit-clients.cfg file :
HOST=hobbit PROC arpwatch 1 LOG /var/log/messages "arpwatch" COLOR=yellow
That is all I've changed, the default section remains the same
The PROC line works fine, but the LOG seems to be ignored.
I have entries in the messages file showing up on the hobbit server :
System logs at Tue Feb 13 11:40:27 CST 2007
No entries in /var/log/messages
Full log /var/log/messages Feb 13 11:09:07 hobbit arpwatch: bogon 0.0.0.0 Feb 13 11:25:34 hobbit arpwatch: bogon 169.254.49.204 Feb 13 11:25:36 hobbit last message repeated 2 times Feb 13 11:30:47 hobbit arpwatch: new station xx.xx.xx.xx Feb 13 11:34:51 hobbit arpwatch: new station xx.xx.xx.xx
As you can see it's not triggering on the arpwatch entries there.
I've tried arpwatch, "arpwatch:", and "arpwatch", as well as %.* in place of /var/log/messages, none of it seems to cause a yellow condition.
Anyone have any pointers on what I'm doing wrong ? The logs all look clean in /var/log/hobbit, only entries for an external script I'm running that has nothing to do with this.
Thanks, Bill Hart
Computer Support Supervisor
Burke Corporation
1516 South D Avenue
PO Box 209
Nevada, IA 50201-0209
(515) 382-3575 x8406
www.BurkeCorp.com
Always make it your best(r)