New to Hobbit --- file monitoring
I'm relatively new to Hobbit, but I'm learning quickly. I'm in a mixed OS environment, with one Linux server, one linux notebook, 2 windows machines, a network printer and a VOIP box. I've managed to get the bb-hosts file so it monitors all the equipment, and I've got the ports set so it's checking ports on the server.
What I'd like to do is do file checking, starting with just to see if a file exists.
I added the following to /etc/hobbit/hobbit-clients.cfg
FILE "/etc/passwd" GREEN NOEXIST TRACK
Just to have it check to see if /etc/passwd existed. (I may have this reversed, but more on that later).
Restarting hobbit, and it still showed "no files being checked"
So I added the following to /etc/hobbit//client-local.cfg
file:/etc/passwd
Restarted Hobbit, still nothing.
I'm clearly missing a piece to the puzzle. There's also a directory /usr/lib/hobbit but I can't imagine any configure files go there.
If it helps, I'm running Ubuntu 7.10.
So if I want to monitor for file existence, on the server, where (and what) do I plug in?
How long did you wait? It takes a bit (10 minutes or more) for changes in client-local.cfg to propagate to the clients (they have to detect the change, and then pull it in, then act on it, and this takes a couple of poll cycles).
And, of course, you must have a working agent on the remote machine. The Hobbit server can run network tests (pings, http, etc.) but it requires remote agents in order to perform many of the client tests (CPU, memory, disk, file, messages, ports, etc.)
GLH
From: Scott Mohnkern [mailto:mohnkern at gmail.com]
Sent: Wednesday, October 31, 2007 3:00 PM
To: hobbit at hswn.dk
Subject: [hobbit] New to Hobbit --- file monitoring
I'm relatively new to Hobbit, but I'm learning quickly. I'm ina mixed OS environment, with one Linux server, one linux notebook, 2 windows machines, a network printer and a VOIP box. I've managed to get the bb-hosts file so it monitors all the equipment, and I've got the ports set so it's checking ports on the server.
What I'd like to do is do file checking, starting with just tosee if a file exists.
I added the following to /etc/hobbit/hobbit-clients.cfg
FILE "/etc/passwd" GREEN NOEXIST TRACK
Just to have it check to see if /etc/passwd existed. (I mayhave this reversed, but more on that later).
Restarting hobbit, and it still showed "no files being checked"
So I added the following to /etc/hobbit//client- local.cfg
file:/etc/passwd
Restarted Hobbit, still nothing.
I'm clearly missing a piece to the puzzle. There's also adirectory /usr/lib/hobbit but I can't imagine any configure files go there.
If it helps, I'm running Ubuntu 7.10.
So if I want to monitor for file existence, on the server, where(and what) do I plug in?
25 minutes and counting.
I'm actually trying to monitor on the server. (So machine X is where the hobbit server is running and machine X has the file I'm trying to monitor).
Scott
On 10/31/07, Hubbard, Greg L <greg.hubbard at eds.com> wrote:
How long did you wait? It takes a bit (10 minutes or more) for changes in client-local.cfg to propagate to the clients (they have to detect the change, and then pull it in, then act on it, and this takes a couple of poll cycles).
And, of course, you must have a working agent on the remote machine. The Hobbit server can run network tests (pings, http, etc.) but it requires remote agents in order to perform many of the client tests (CPU, memory, disk, file, messages, ports, etc.)
GLH
*From:* Scott Mohnkern [mailto:mohnkern at gmail.com] *Sent:* Wednesday, October 31, 2007 3:00 PM *To:* hobbit at hswn.dk *Subject:* [hobbit] New to Hobbit --- file monitoring
I'm relatively new to Hobbit, but I'm learning quickly. I'm in a mixed OS environment, with one Linux server, one linux notebook, 2 windows machines, a network printer and a VOIP box. I've managed to get the bb-hosts file so it monitors all the equipment, and I've got the ports set so it's checking ports on the server.
What I'd like to do is do file checking, starting with just to see if a file exists.
I added the following to /etc/hobbit/hobbit-clients.cfg
FILE "/etc/passwd" GREEN NOEXIST TRACK
Just to have it check to see if /etc/passwd existed. (I may have this reversed, but more on that later).
Restarting hobbit, and it still showed "no files being checked"
So I added the following to /etc/hobbit//client- local.cfg
file:/etc/passwd
Restarted Hobbit, still nothing.
I'm clearly missing a piece to the puzzle. There's also a directory /usr/lib/hobbit but I can't imagine any configure files go there.
If it helps, I'm running Ubuntu 7.10.
So if I want to monitor for file existence, on the server, where (and what) do I plug in?
On Wednesday 31 October 2007, Hubbard, Greg L wrote:
How long did you wait? It takes a bit (10 minutes or more) for changes in client-local.cfg to propagate to the clients (they have to detect the change, and then pull it in, then act on it, and this takes a couple of poll cycles). I tried to set up file monitoring today and after 1hr, I fixed it by restarting the hobbit server. Not reloading, restarting. So, restart your hobbit server after you changed the config files and the change is not detected.
You can also take a look in the tmp directory of the client. There should be a logfetch file if the client picks up the new configuration. There should be 2 files, one with the settings on the hobbit server and one with the status (this is a file used by the hobbit client to track the logfile).
Stef
This may be where I'm getting confused. On the machine where hobbit is reporting data, (i.e. the machinename I use for the url) does the client need to be running? Where are the config files for the client typically stored? I've been editing files /etc/hobbit But I wonder if those are just the server files, and not the client files (assuming the client needs to be running as well on the machine that is the server.
Scott
On 10/31/07, Stef Coene <stef.coene at docum.org> wrote:
On Wednesday 31 October 2007, Hubbard, Greg L wrote:
How long did you wait? It takes a bit (10 minutes or more) for changes in client-local.cfg to propagate to the clients (they have to detect the change, and then pull it in, then act on it, and this takes a couple of poll cycles). I tried to set up file monitoring today and after 1hr, I fixed it by restarting the hobbit server. Not reloading, restarting. So, restart your hobbit server after you changed the config files and the change is not detected.
You can also take a look in the tmp directory of the client. There should be a logfetch file if the client picks up the new configuration. There should be 2 files, one with the settings on the hobbit server and one with the status (this is a file used by the hobbit client to track the logfile).
Stef
To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk
On Wednesday 31 October 2007, Scott Mohnkern wrote:
This may be where I'm getting confused. On the machine where hobbit is reporting data, (i.e. the machinename I use for the url) does the client need to be running? Where are the config files for the client typically stored? I've been editing files /etc/hobbit But I wonder if those are just the server files, and not the client files (assuming the client needs to be running as well on the machine that is the server. I'm afraid you need some more reading ;) Hobbit is client server. So there is a server that receives info from the client. The server is also doing netwerk tests. The cient sends information to the server that's interpreted by the server.
The servers creates the koloms, trends, ... and does all the logic.
For file monitoring you need to configure the server so the next time the client connects to the server to send the information, the client also receives the files it needs the to monitor. The next time the client sends all information to the server including the monitord files.
So on the server you typically needs the client software so you can monitor the machine that runs the server server software. Depending on your setup, the server can include the client or this can be a seperate package.
Stef
~/hobbit/client/* is where the client stuff lives. The server runs a local client. On remote systems, you usually clone the ~/hobbit/client/* part to other machines (assuming the same architecture). As you get more into it, you will figure out how to make client distributions.
If you are seeing anything reported for CPU, memory, disk, etc. on your server, then the client is running. You don't have to do anything to enable it.
From: Scott Mohnkern [mailto:mohnkern at gmail.com]
Sent: Wednesday, October 31, 2007 3:52 PM
To: hobbit at hswn.dk
Subject: Re: [hobbit] New to Hobbit --- file monitoring
This may be where I'm getting confused. On the machine wherehobbit is reporting data, (i.e. the machinename I use for the url) does the client need to be running? Where are the config files for the client typically stored? I've been editing files /etc/hobbit But I wonder if those are just the server files, and not the client files (assuming the client needs to be running as well on the machine that is the server.
Scott
On 10/31/07, Stef Coene <stef.coene at docum.org> wrote:
On Wednesday 31 October 2007, Hubbard, Greg L wrote:
> How long did you wait? It takes a bit (10 minutes ormore) for changes > in client-local.cfg to propagate to the clients (they have to detect the > change, and then pull it in, then act on it, and this takes a couple of > poll cycles). I tried to set up file monitoring today and after 1hr, I fixed it by restarting the hobbit server. Not reloading, restarting. So, restart your hobbit server after you changed the config files and the change is not detected. You can also take a look in the tmp directory of the client. There should be a logfetch file if the client picks up the new configuration. There should be 2 files, one with the settings on the hobbit server and one with the status (this is a file used by the hobbit client to track the logfile). Stef To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk
Thanks, this was the critical piece of information I was missing. There are client configuration files in /etc/hobbit that I was editing, and clearly they aren't the correct ones. I need to edit the ones in /usr/lib/hobbit/client.
Back to editing what I hope is the correct config file. I should be able to put
FILE "/etc/passwd" GREEN NOEXIST TRACK in ~/usr/lib/hobbit/client/etc/hobbit-clients.cfg
and then start the hobbit client with /usr/lib/hobbit/runclient.sh start
and get reporting, yes?
On 10/31/07, Hubbard, Greg L <greg.hubbard at eds.com> wrote:
~/hobbit/client/* is where the client stuff lives. The server runs a local client. On remote systems, you usually clone the ~/hobbit/client/* part to other machines (assuming the same architecture). As you get more into it, you will figure out how to make client distributions.
If you are seeing anything reported for CPU, memory, disk, etc. on your server, then the client is running. You don't have to do anything to enable it.
*From:* Scott Mohnkern [mailto:mohnkern at gmail.com] *Sent:* Wednesday, October 31, 2007 3:52 PM *To:* hobbit at hswn.dk *Subject:* Re: [hobbit] New to Hobbit --- file monitoring
This may be where I'm getting confused. On the machine where hobbit is reporting data, (i.e. the machinename I use for the url) does the client need to be running? Where are the config files for the client typically stored? I've been editing files /etc/hobbit But I wonder if those are just the server files, and not the client files (assuming the client needs to be running as well on the machine that is the server.
Scott
On 10/31/07, Stef Coene <stef.coene at docum.org> wrote:
On Wednesday 31 October 2007, Hubbard, Greg L wrote:
How long did you wait? It takes a bit (10 minutes or more) for changes in client-local.cfg to propagate to the clients (they have to detect the change, and then pull it in, then act on it, and this takes a couple of poll cycles). I tried to set up file monitoring today and after 1hr, I fixed it by restarting the hobbit server. Not reloading, restarting. So, restart your hobbit server after you changed the config files and the change is not detected.
You can also take a look in the tmp directory of the client. There should be a logfetch file if the client picks up the new configuration. There should be 2 files, one with the settings on the hobbit server and one with the status (this is a file used by the hobbit client to track the logfile).
Stef
To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk
On Wednesday 31 October 2007, Scott Mohnkern wrote:
Thanks, this was the critical piece of information I was missing. There are client configuration files in /etc/hobbit that I was editing, and clearly they aren't the correct ones. I need to edit the ones in /usr/lib/hobbit/client.
Back to editing what I hope is the correct config file. I should be able to put
FILE "/etc/passwd" GREEN NOEXIST TRACK in ~/usr/lib/hobbit/client/etc/hobbit-clients.cfg
and then start the hobbit client with /usr/lib/hobbit/runclient.sh start
and get reporting, yes? No, this has to go in the hobbit-clients.cfg file on the _server_. The server receives the data from the client (including the log file information) and needs to know what to do with it. Before the client sends file information to the server, you need to configure client-local.cfg on the _server_. So all configuration is done on the server.
If the client and the server is the same machine, it can be tricky to find the right config file. If you install the hobbit server from source, all files are placed in the same sub directory so it is clear to know what's the server and what's the client.
Stef
Okay, did a file search for hobbit-clients.cfg and found:
/etc/hobbit/hobbit-clients.cfg
Then looked in that file and found:
mohnkern at Casa-Scott:/etc/hobbit$ grep FILE hobbit-clients.cfg
FILE : Changes the "files" status according to meta-data for files.
FILE filename [color] [things to check] [TRACK]
FILE "/etc/passwd" GREEN NOEXIST TRACK
There's also a hobbit-clients.cfg in /usr/lib/hobbit/server/etc The entry is there as well.
However, at the hobbit screen, the file entry is still coming up grey, and "no files being checked"
Scott
On 11/1/07, Stef Coene <stef.coene at docum.org> wrote:
On Wednesday 31 October 2007, Scott Mohnkern wrote:
Thanks, this was the critical piece of information I was missing. There are client configuration files in /etc/hobbit that I was editing, and clearly they aren't the correct ones. I need to edit the ones in /usr/lib/hobbit/client.
Back to editing what I hope is the correct config file. I should be able to put
FILE "/etc/passwd" GREEN NOEXIST TRACK in ~/usr/lib/hobbit/client/etc/hobbit-clients.cfg
and then start the hobbit client with /usr/lib/hobbit/runclient.sh start
and get reporting, yes? No, this has to go in the hobbit-clients.cfg file on the _server_. The server receives the data from the client (including the log file information) and needs to know what to do with it. Before the client sends file information to the server, you need to configure client-local.cfg on the _server_. So all configuration is done on the server.
If the client and the server is the same machine, it can be tricky to find the right config file. If you install the hobbit server from source, all files are placed in the same sub directory so it is clear to know what's the server and what's the client.
Stef
To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk
Did you install this from scratch, or use someone's package to install? It is surprising that you have both directories (unless one is a symlink for the other).
I use Solaris for the most part, so I had to build my own configuration. I don't like to scatter things throughout the file system, so everything "server" is under hobbit/server and everything "client" is under hobbit/client.
I think there is a log file you can check, but I don't where it might be on your system. You might want to glance through the man pages for the various daemons and see where they write their logs.
GLH
From: Scott Mohnkern [mailto:mohnkern at gmail.com]
Sent: Thursday, November 01, 2007 2:02 PM
To: hobbit at hswn.dk
Subject: Re: [hobbit] New to Hobbit --- file monitoring
Okay, did a file search for hobbit-clients.cfg and found:
/etc/hobbit/hobbit-clients.cfg
Then looked in that file and found:
mohnkern at Casa-Scott:/etc/hobbit$ grep FILE hobbit-clients.cfg
# FILE : Changes the "files" status according to meta-datafor files. # FILE filename [color] [things to check] [TRACK] FILE "/etc/passwd" GREEN NOEXIST TRACK
There's also a hobbit-clients.cfg in /usr/lib/hobbit/server/etcThe entry is there as well.
However, at the hobbit screen, the file entry is still coming upgrey, and "no files being checked"
Scott
On 11/1/07, Stef Coene <stef.coene at docum.org> wrote:
On Wednesday 31 October 2007, Scott Mohnkern wrote:
> Thanks, this was the critical piece of information Iwas missing. There > are client configuration files in /etc/hobbit that I was editing, and > clearly they aren't the correct ones. I need to edit the ones in > /usr/lib/hobbit/client. > > Back to editing what I hope is the correct config file. I should be able > to put > > FILE "/etc/passwd" GREEN NOEXIST TRACK > in ~/usr/lib/hobbit/client/etc/hobbit- clients.cfg > > and then start the hobbit client with /usr/lib/hobbit/runclient.sh start > > and get reporting, yes? No, this has to go in the hobbit-clients.cfg file on the _server_. The server receives the data from the client (including the log file information) and needs to know what to do with it. Before the client sends file information to the server, you need to configure client-local.cfg on the _server_. So all configuration is done on the server. If the client and the server is the same machine, it can be tricky to find the right config file. If you install the hobbit server from source, all files are placed in the same sub directory so it is clear to know what's the server and what's the client. Stef To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk
I used the Ubuntu apt-get to install it. There's a hobbit log in /var/log/hobbit that seems to be getting updated:
I noted the following in clientlaunch.log.1:
Cannot open configuration file /usr/lib/hobbit/client/etc/clientlaunch.cfg: No such file or directory
It looks like it may be using hobbitlaunch.cfg for the client.
Scott
On 11/1/07, Hubbard, Greg L <greg.hubbard at eds.com> wrote:
Did you install this from scratch, or use someone's package to install? It is surprising that you have both directories (unless one is a symlink for the other).
I use Solaris for the most part, so I had to build my own configuration. I don't like to scatter things throughout the file system, so everything "server" is under hobbit/server and everything "client" is under hobbit/client.
I think there is a log file you can check, but I don't where it might be on your system. You might want to glance through the man pages for the various daemons and see where they write their logs.
GLH
*From:* Scott Mohnkern [mailto:mohnkern at gmail.com] *Sent:* Thursday, November 01, 2007 2:02 PM *To:* hobbit at hswn.dk *Subject:* Re: [hobbit] New to Hobbit --- file monitoring
Okay, did a file search for hobbit-clients.cfg and found:
/etc/hobbit/hobbit-clients.cfg
Then looked in that file and found:
mohnkern at Casa-Scott:/etc/hobbit$ grep FILE hobbit-clients.cfg
FILE : Changes the "files" status according to meta-data for files.
FILE filename [color] [things to check] [TRACK]
FILE "/etc/passwd" GREEN NOEXIST TRACK
There's also a hobbit-clients.cfg in /usr/lib/hobbit/server/etc The entry is there as well.
However, at the hobbit screen, the file entry is still coming up grey, and "no files being checked"
Scott
On 11/1/07, Stef Coene <stef.coene at docum.org> wrote:
On Wednesday 31 October 2007, Scott Mohnkern wrote:
Thanks, this was the critical piece of information I was missing. There are client configuration files in /etc/hobbit that I was editing, and clearly they aren't the correct ones. I need to edit the ones in /usr/lib/hobbit/client.
Back to editing what I hope is the correct config file. I should be able to put
FILE "/etc/passwd" GREEN NOEXIST TRACK in ~/usr/lib/hobbit/client/etc/hobbit- clients.cfg
and then start the hobbit client with /usr/lib/hobbit/runclient.sh start
and get reporting, yes? No, this has to go in the hobbit-clients.cfg file on the _server_. The server receives the data from the client (including the log file information) and needs to know what to do with it. Before the client sends file information to the server, you need to configure client-local.cfg on the _server_. So all configuration is done on the server.
If the client and the server is the same machine, it can be tricky to find the right config file. If you install the hobbit server from source, all files are placed in the same sub directory so it is clear to know what's the server and what's the client.
Stef
To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk
On Thursday 01 November 2007, Scott Mohnkern wrote:
I used the Ubuntu apt-get to install it. There's a hobbit log in /var/log/hobbit that seems to be getting updated:
I noted the following in clientlaunch.log.1:
Cannot open configuration file /usr/lib/hobbit/client/etc/clientlaunch.cfg: No such file or directory
It looks like it may be using hobbitlaunch.cfg for the client. It is possible that you only have to install the server and not the client. I don't know the ubuntu packages, but by default, the server includes the client. So if you install the client and server you can have duplicate config files.
Stef
I've compiled my server and client from source. I know the client is reporting to my server as it reports the cpu/load/disk/etc just fine.
At the bottom of my /home/shire/server/etc/hobbit-clients.cfg
HOST="%myhost.foo.bar" #also tried it without the %, i know that my BBD had %, not sure what it means =) FILE "/etc/passwd" GREEN NOEXIST TRACK
I still get "no files checked after two rewrites of the page.
Josh
On 11/1/07, Stef Coene <stef.coene at docum.org> wrote:
On Thursday 01 November 2007, Scott Mohnkern wrote:
I used the Ubuntu apt-get to install it. There's a hobbit log in /var/log/hobbit that seems to be getting updated:
I noted the following in clientlaunch.log.1:
Cannot open configuration file /usr/lib/hobbit/client/etc/clientlaunch.cfg: No such file or directory
It looks like it may be using hobbitlaunch.cfg for the client. It is possible that you only have to install the server and not the client. I don't know the ubuntu packages, but by default, the server includes the client. So if you install the client and server you can have duplicate config files.
Stef
To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk
-- Josh Luthman Office: 937-552-2340 Direct: 937-552-2343 1100 Wayne St Suite 1337 Troy, OH 45373
Those who don't understand UNIX are condemned to reinvent it, poorly. --- Henry Spencer
On Thursday 01 November 2007, Josh Luthman wrote:
I've compiled my server and client from source. I know the client is reporting to my server as it reports the cpu/load/disk/etc just fine.
At the bottom of my /home/shire/server/etc/hobbit-clients.cfg
HOST="%myhost.foo.bar" #also tried it without the %, i know that my BBD had %, not sure what it means =) FILE "/etc/passwd" GREEN NOEXIST TRACK
I still get "no files checked after two rewrites of the page. In config file server/etc/client-local.cfg you specify what logfile the client will report to the server. You have to add a section for your client to it.
Once the client picks this up (to be sure restart the hobbit server and wait at least 10 minutes), the msgs column should be green and the logfile should appear on it. Once this works, you can change hobbit-clients.cfg so the server knows the yellow and green conditions.
Stef
I also check /usr/local/lib/hobbit/server/etc/client-local.cfg and had the following
FILE "/etc/passwd" GREEN NOEXIST TRACK
On 11/1/07, Stef Coene <stef.coene at docum.org> wrote:
On Wednesday 31 October 2007, Scott Mohnkern wrote:
Thanks, this was the critical piece of information I was missing. There are client configuration files in /etc/hobbit that I was editing, and clearly they aren't the correct ones. I need to edit the ones in /usr/lib/hobbit/client.
Back to editing what I hope is the correct config file. I should be able to put
FILE "/etc/passwd" GREEN NOEXIST TRACK in ~/usr/lib/hobbit/client/etc/hobbit-clients.cfg
and then start the hobbit client with /usr/lib/hobbit/runclient.sh start
and get reporting, yes? No, this has to go in the hobbit-clients.cfg file on the _server_. The server receives the data from the client (including the log file information) and needs to know what to do with it. Before the client sends file information to the server, you need to configure client-local.cfg on the _server_. So all configuration is done on the server.
If the client and the server is the same machine, it can be tricky to find the right config file. If you install the hobbit server from source, all files are placed in the same sub directory so it is clear to know what's the server and what's the client.
Stef
To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk
On Wednesday 31 October 2007 22:47:22 Stef Coene wrote:
On Wednesday 31 October 2007, Hubbard, Greg L wrote:
How long did you wait? It takes a bit (10 minutes or more) for changes in client-local.cfg to propagate to the clients (they have to detect the change, and then pull it in, then act on it, and this takes a couple of poll cycles).
I tried to set up file monitoring today and after 1hr, I fixed it by restarting the hobbit server. Not reloading, restarting. So, restart your hobbit server after you changed the config files and the change is not detected.
I've also seen some cases where I need a restart for a threshold to be picked up, but I can't remember needing it for a change in client-local.cfg. So far it looks only like it happens when change where a hosts threshold configuration is (e.g. when adding a new HOST= section where the host was previously catered to by the DEFAULT).
Regards, Buchan
When all else fails, nuke it and start over. I did an apt-get remove hobbit, and then a dpkg -- purge. Then I removed any files I could find. Then I downloaded the Ubuntu deb file and installed it. It put the configuration files in /etc/hobbit and it started fine
I edited /etc/hobbit/hobbit-clients.cfg and added the following line:
PROC ntpd 1 99 green "TEXT=NTPD is up"
Restarted hobbit, and in a few minutes, it started reporting as expected.
Then I added:
PORT "LOCAL=%(:8888)" TEXT="Gnump is up"
To the same file, (/etc/hobbit/hobbit-clients.cfg) and restared hobbit.
A few minutes later, the ports section started reporting, as expected.
(Though I realize that its a bit off, which I need to fix)
Then I added:
FILE /etc/passwd GREEN NOEXIST track
Reading the documentation inside hobbit-clients.cfg I edited /etc/hobbit/client-local.cfg and added the following line: file:/etc/passwd
restarted hobbit, waited 5 minutes. No luck.
I'm pretty convinced that either:
- the format of the line in /etc/hobbit/client-local.cfg or /etc/hobbit/hobbit-clients.cfg is incorrect, or
- There's something else I need to edit.
Try removing the TRACK keyword, and then change NOEXIST to lower case. I think Henrik has reported that there are a few bugs in this code, and it is not always clear when case matters and when it doesn't, or when the order of the arguments matters.
From: Scott Mohnkern [mailto:mohnkern at gmail.com] Sent: Thursday, November 01, 2007 3:10 PM To: hobbit at hswn.dk Subject: [hobbit] Re: New to Hobbit --- file monitoring
When all else fails, nuke it and start over. I did an apt-getremove hobbit, and then a dpkg -- purge. Then I removed any files I could find. Then I downloaded the Ubuntu deb file and installed it. It put the configuration files in /etc/hobbit and it started fine
I edited /etc/hobbit/hobbit-clients.cfg and added the followingline:
PROC ntpd 1 99 green "TEXT=NTPD is up"
Restarted hobbit, and in a few minutes, it started reporting asexpected.
Then I added:
PORT "LOCAL=%(:8888)" TEXT="Gnump is up"
To the same file, (/etc/hobbit/hobbit-clients.cfg) and restaredhobbit.
A few minutes later, the ports section started reporting, asexpected.
(Though I realize that its a bit off, which I need to fix)
Then I added:
FILE /etc/passwd GREEN NOEXIST track
Reading the documentation inside hobbit-clients.cfg I edited/etc/hobbit/client- local.cfg and added the following line: file:/etc/passwd
restarted hobbit, waited 5 minutes. No luck.
I'm pretty convinced that either:
1. the format of the line in /etc/hobbit/client-local.cfg or/etc/hobbit/hobbit-clients.cfg is incorrect, or 2. There's something else I need to edit.
Thanks for the help. I edited /etc/hobbit/hobbit-clients.cfg so the line reads:
FILE /etc/passwd GREEN noexist
still no joy.
Is there anyone on the list that has an example of a FILE line in their hobbit-clients.cfg file?
On 11/1/07, Hubbard, Greg L <greg.hubbard at eds.com> wrote:
Try removing the TRACK keyword, and then change NOEXIST to lower case. I think Henrik has reported that there are a few bugs in this code, and it is not always clear when case matters and when it doesn't, or when the order of the arguments matters.
*From:* Scott Mohnkern [mailto:mohnkern at gmail.com] *Sent:* Thursday, November 01, 2007 3:10 PM *To:* hobbit at hswn.dk *Subject:* [hobbit] Re: New to Hobbit --- file monitoring
When all else fails, nuke it and start over. I did an apt-get remove hobbit, and then a dpkg -- purge. Then I removed any files I could find. Then I downloaded the Ubuntu deb file and installed it. It put the configuration files in /etc/hobbit and it started fine
I edited /etc/hobbit/hobbit-clients.cfg and added the following line:
PROC ntpd 1 99 green "TEXT=NTPD is up"
Restarted hobbit, and in a few minutes, it started reporting as expected.
Then I added:
PORT "LOCAL=%(:8888)" TEXT="Gnump is up"
To the same file, (/etc/hobbit/hobbit-clients.cfg) and restared hobbit.
A few minutes later, the ports section started reporting, as expected.
(Though I realize that its a bit off, which I need to fix)
Then I added:
FILE /etc/passwd GREEN NOEXIST track
Reading the documentation inside hobbit-clients.cfg I edited /etc/hobbit/client- local.cfg and added the following line: file:/etc/passwd
restarted hobbit, waited 5 minutes. No luck.
I'm pretty convinced that either:
- the format of the line in /etc/hobbit/client-local.cfg or /etc/hobbit/hobbit-clients.cfg is incorrect, or
- There's something else I need to edit.
Well, at least its replicatable.
Scott
On 11/1/07, Scott Mohnkern <mohnkern at gmail.com> wrote:
Thanks for the help. I edited /etc/hobbit/hobbit-clients.cfg so the line reads:
FILE /etc/passwd GREEN noexist
still no joy.
Is there anyone on the list that has an example of a FILE line in their hobbit-clients.cfg file?
On 11/1/07, Hubbard, Greg L < greg.hubbard at eds.com> wrote:
Try removing the TRACK keyword, and then change NOEXIST to lower case. I think Henrik has reported that there are a few bugs in this code, and it is not always clear when case matters and when it doesn't, or when the order of the arguments matters.
*From:* Scott Mohnkern [mailto:mohnkern at gmail.com] *Sent:* Thursday, November 01, 2007 3:10 PM *To:* hobbit at hswn.dk *Subject:* [hobbit] Re: New to Hobbit --- file monitoring
When all else fails, nuke it and start over. I did an apt-get remove hobbit, and then a dpkg -- purge. Then I removed any files I could find. Then I downloaded the Ubuntu deb file and installed it. It put the configuration files in /etc/hobbit and it started fine
I edited /etc/hobbit/hobbit-clients.cfg and added the following line:
PROC ntpd 1 99 green "TEXT=NTPD is up"
Restarted hobbit, and in a few minutes, it started reporting as expected.
Then I added:
PORT "LOCAL=%(:8888)" TEXT="Gnump is up"
To the same file, (/etc/hobbit/hobbit-clients.cfg) and restared hobbit.
A few minutes later, the ports section started reporting, as expected.
(Though I realize that its a bit off, which I need to fix)
Then I added:
FILE /etc/passwd GREEN NOEXIST track
Reading the documentation inside hobbit-clients.cfg I edited /etc/hobbit/client- local.cfg and added the following line: file:/etc/passwd
restarted hobbit, waited 5 minutes. No luck.
I'm pretty convinced that either:
- the format of the line in /etc/hobbit/client-local.cfg or /etc/hobbit/hobbit-clients.cfg is incorrect, or
- There's something else I need to edit.
Try this
FILE /etc/passwd noexist COLOR=green TRACK
From: Scott Mohnkern [mailto:mohnkern at gmail.com]
Sent: Thursday, November 01, 2007 3:39 PM
To: hobbit at hswn.dk
Subject: Re: [hobbit] Re: New to Hobbit --- file monitoring
Well, at least its replicatable.
Scott
On 11/1/07, Scott Mohnkern < mohnkern at gmail.com<mailto:mohnkern at gmail.com> > wrote:
Thanks for the help. I edited/etc/hobbit/hobbit-clients.cfg so the line reads:
FILE /etc/passwd GREEN noexist
still no joy.
Is there anyone on the list that has an example of a
FILE line in their hobbit-clients.cfg file?
On 11/1/07, Hubbard, Greg L < greg.hubbard at eds.com
<mailto:greg.hubbard at eds.com> > wrote:
Try removing the TRACK keyword, and then changeNOEXIST to lower case. I think Henrik has reported that there are a few bugs in this code, and it is not always clear when case matters and when it doesn't, or when the order of the arguments matters.
From: Scott Mohnkern [mailto:mohnkern at gmail.com]
Sent: Thursday, November 01, 2007 3:10 PM
To: hobbit at hswn.dk
Subject: [hobbit] Re: New to Hobbit --- filemonitoring
When all else fails, nuke it and startover. I did an apt-get remove hobbit, and then a dpkg -- purge. Then I removed any files I could find. Then I downloaded the Ubuntu deb file and installed it. It put the configuration files in /etc/hobbit and it started fine I edited /etc/hobbit/hobbit-clients.cfg and added the following line: PROC ntpd 1 99 green "TEXT=NTPD is up" Restarted hobbit, and in a few minutes, it started reporting as expected. Then I added: PORT "LOCAL=%(:8888)" TEXT="Gnump is up" To the same file, (/etc/hobbit/hobbit-clients.cfg) and restared hobbit. A few minutes later, the ports section started reporting, as expected. (Though I realize that its a bit off, which I need to fix) Then I added: FILE /etc/passwd GREEN NOEXIST track Reading the documentation inside hobbit-clients.cfg I edited /etc/hobbit/client- local.cfg and added the following line: file:/etc/passwd restarted hobbit, waited 5 minutes. No luck. I'm pretty convinced that either: 1. the format of the line in /etc/hobbit/client-local.cfg or /etc/hobbit/hobbit-clients.cfg is incorrect, or 2. There's something else I need to edit.
Nope, no joy there either. the man page seems to think it should be:
FILE <full path to file><color> <condition>
and that's pretty consistent with the other things I've put into the same file, which come up.
I also tried:
FILE "/etc/passwd" green noexist TRACK
and
FILE "/etc/passwd" green noexist
Scott
On 11/1/07, Hubbard, Greg L <greg.hubbard at eds.com> wrote:
Try this
FILE /etc/passwd noexist COLOR=green TRACK
*From:* Scott Mohnkern [mailto:mohnkern at gmail.com] *Sent:* Thursday, November 01, 2007 3:39 PM *To:* hobbit at hswn.dk *Subject:* Re: [hobbit] Re: New to Hobbit --- file monitoring
Well, at least its replicatable.
Scott
On 11/1/07, Scott Mohnkern < mohnkern at gmail.com> wrote:
Thanks for the help. I edited /etc/hobbit/hobbit-clients.cfg so the line reads:
FILE /etc/passwd GREEN noexist
still no joy.
Is there anyone on the list that has an example of a FILE line in their hobbit-clients.cfg file?
On 11/1/07, Hubbard, Greg L < greg.hubbard at eds.com> wrote:
Try removing the TRACK keyword, and then change NOEXIST to lower case. I think Henrik has reported that there are a few bugs in this code, and it is not always clear when case matters and when it doesn't, or when the order of the arguments matters.
*From:* Scott Mohnkern [mailto:mohnkern at gmail.com] *Sent:* Thursday, November 01, 2007 3:10 PM *To:* hobbit at hswn.dk *Subject:* [hobbit] Re: New to Hobbit --- file monitoring
When all else fails, nuke it and start over. I did an apt-get remove hobbit, and then a dpkg -- purge. Then I removed any files I could find. Then I downloaded the Ubuntu deb file and installed it. It put the configuration files in /etc/hobbit and it started fine
I edited /etc/hobbit/hobbit-clients.cfg and added the following line:
PROC ntpd 1 99 green "TEXT=NTPD is up"
Restarted hobbit, and in a few minutes, it started reporting as expected.
Then I added:
PORT "LOCAL=%(:8888)" TEXT="Gnump is up"
To the same file, (/etc/hobbit/hobbit-clients.cfg) and restared hobbit.
A few minutes later, the ports section started reporting, as expected.
(Though I realize that its a bit off, which I need to fix)
Then I added:
FILE /etc/passwd GREEN NOEXIST track
Reading the documentation inside hobbit-clients.cfg I edited /etc/hobbit/client- local.cfg and added the following line: file:/etc/passwd
restarted hobbit, waited 5 minutes. No luck.
I'm pretty convinced that either:
- the format of the line in /etc/hobbit/client-local.cfg or /etc/hobbit/hobbit-clients.cfg is incorrect, or
- There's something else I need to edit.
Here is something I use that works. This is a "bookend" problem -- both parts have to be done correctly. Hobbit tends to silently ignore errors in configuration files.
In client-local.cfg
[myserver.mydomain.com] file:/opt2/log/syslog.log file:/opt2/log/security.log file:/opt2/log/snmptrap.log
in hobbit-clients.cfg
HOST=myserver.mydomain.com FILE /opt2/log/syslog.log mtime<600 size<2G TRACK FILE /opt2/log/security.log TRACK FILE /opt2/log/snmptrap.log mtime<600 size<2G TRACK
Some things to note
a) the host names match exactly, and they are not enclosed in double quotes.
b) the file names match exactly
c) this example is lifted from my running system, with the host name changed to protect the guilty. I have some other examples that use color in the "COLOR=color" format, which I believe is required, but I would have to edit them more before I can post them.
d) the client-local.cfg file has some predefined sections in it. Don't use them. Make new ones. Only one section can be applied to a host, so cut and paste will be your friend.
From: Scott Mohnkern [mailto:mohnkern at gmail.com]
Sent: Thursday, November 01, 2007 4:00 PM
To: hobbit at hswn.dk
Subject: Re: [hobbit] Re: New to Hobbit --- file monitoring
Nope, no joy there either. the man page seems to think itshould be:
FILE <full path to file><color> <condition>
and that's pretty consistent with the other things I've put intothe same file, which come up.
I also tried:
FILE "/etc/passwd" green noexist TRACK
and
FILE "/etc/passwd" green noexist
Scott
On 11/1/07, Hubbard, Greg L <greg.hubbard at eds.com> wrote:
Try this
FILE /etc/passwd noexist COLOR=green TRACK From: Scott Mohnkern [mailto:mohnkern at gmail.com]
Sent: Thursday, November 01, 2007 3:39 PM
To: hobbit at hswn.dk
Subject: Re: [hobbit] Re: New to Hobbit --- filemonitoring Well, at least its replicatable. Scott On 11/1/07, Scott Mohnkern < mohnkern at gmail.com <mailto:mohnkern at gmail.com> > wrote:
Thanks for the help. I edited/etc/hobbit/hobbit-clients.cfg so the line reads:
FILE /etc/passwd GREEN noexist
still no joy.
Is there anyone on the list that has an
example of a FILE line in their hobbit-clients.cfg file?
On 11/1/07, Hubbard, Greg L <
greg.hubbard at eds.com <mailto:greg.hubbard at eds.com> > wrote:
Try removing the TRACK keyword, and thenchange NOEXIST to lower case. I think Henrik has reported that there are a few bugs in this code, and it is not always clear when case matters and when it doesn't, or when the order of the arguments matters.
From: Scott Mohnkern[mailto:mohnkern at gmail.com] Sent: Thursday, November 01, 2007 3:10 PM To: hobbit at hswn.dk Subject: [hobbit] Re: New to Hobbit --- file monitoring
When all else fails, nuke it and startover. I did an apt-get remove hobbit, and then a dpkg -- purge. Then I removed any files I could find. Then I downloaded the Ubuntu deb file and installed it. It put the configuration files in /etc/hobbit and it started fine I edited /etc/hobbit/hobbit-clients.cfg and added the following line: PROC ntpd 1 99 green "TEXT=NTPD is up" Restarted hobbit, and in a few minutes, it started reporting as expected. Then I added: PORT "LOCAL=%(:8888)" TEXT="Gnump is up" To the same file, (/etc/hobbit/hobbit-clients.cfg) and restared hobbit. A few minutes later, the ports section started reporting, as expected. (Though I realize that its a bit off, which I need to fix) Then I added: FILE /etc/passwd GREEN NOEXIST track Reading the documentation inside hobbit-clients.cfg I edited /etc/hobbit/client- local.cfg and added the following line: file:/etc/passwd restarted hobbit, waited 5 minutes. No luck. I'm pretty convinced that either: 1. the format of the line in /etc/hobbit/client-local.cfg or /etc/hobbit/hobbit-clients.cfg is incorrect, or 2. There's something else I need to edit.
I'm basing my changes on Greg. These still do not work, though I believe they're a step towards the right direction:
#hobbit-clients.cfg HOST=foo.bar.com FILE "/etc/passwd" GREEN NOEXIST TRACK
#client-local.cfg [foo.bar.com] file:/etc/passwd
I do notice that on my main machine running the server and client that there is Client Data available if you click on the Files test. There is no client data from the foo.bar.com files test, however. I think my problem right now is that I'm not getting the data from foo.bar.com to BBD. Any ideas at this point?
On 11/1/07, Hubbard, Greg L <greg.hubbard at eds.com> wrote:
Here is something I use that works. This is a "bookend" problem -- both parts have to be done correctly. Hobbit tends to silently ignore errors in configuration files.
In client-local.cfg
[myserver.mydomain.com] file:/opt2/log/syslog.log file:/opt2/log/security.log file:/opt2/log/snmptrap.log
in hobbit-clients.cfg
HOST=myserver.mydomain.com FILE /opt2/log/syslog.log mtime<600 size<2G TRACK FILE /opt2/log/security.log TRACK FILE /opt2/log/snmptrap.log mtime<600 size<2G TRACK
Some things to note
a) the host names match exactly, and they are not enclosed in double quotes.
b) the file names match exactly
c) this example is lifted from my running system, with the host name changed to protect the guilty. I have some other examples that use color in the "COLOR=color" format, which I believe is required, but I would have to edit them more before I can post them.
d) the client-local.cfg file has some predefined sections in it. Don't use them. Make new ones. Only one section can be applied to a host, so cut and paste will be your friend.
*From:* Scott Mohnkern [mailto:mohnkern at gmail.com] *Sent:* Thursday, November 01, 2007 4:00 PM *To:* hobbit at hswn.dk *Subject:* Re: [hobbit] Re: New to Hobbit --- file monitoring
Nope, no joy there either. the man page seems to think it should be:
FILE <full path to file><color> <condition>
and that's pretty consistent with the other things I've put into the same file, which come up.
I also tried:
FILE "/etc/passwd" green noexist TRACK
and
FILE "/etc/passwd" green noexist
Scott
On 11/1/07, Hubbard, Greg L <greg.hubbard at eds.com> wrote:
Try this
FILE /etc/passwd noexist COLOR=green TRACK
*From:* Scott Mohnkern [mailto:mohnkern at gmail.com] *Sent:* Thursday, November 01, 2007 3:39 PM *To:* hobbit at hswn.dk *Subject:* Re: [hobbit] Re: New to Hobbit --- file monitoring
Well, at least its replicatable.
Scott
On 11/1/07, Scott Mohnkern < mohnkern at gmail.com> wrote:
Thanks for the help. I edited /etc/hobbit/hobbit-clients.cfg so the line reads:
FILE /etc/passwd GREEN noexist
still no joy.
Is there anyone on the list that has an example of a FILE line in their hobbit-clients.cfg file?
On 11/1/07, Hubbard, Greg L < greg.hubbard at eds.com> wrote:
Try removing the TRACK keyword, and then change NOEXIST to lower case. I think Henrik has reported that there are a few bugs in this code, and it is not always clear when case matters and when it doesn't, or when the order of the arguments matters.
*From:* Scott Mohnkern [mailto:mohnkern at gmail.com] *Sent:* Thursday, November 01, 2007 3:10 PM *To:* hobbit at hswn.dk *Subject:* [hobbit] Re: New to Hobbit --- file monitoring
When all else fails, nuke it and start over. I did an apt-get remove hobbit, and then a dpkg -- purge. Then I removed any files I could find. Then I downloaded the Ubuntu deb file and installed it. It put the configuration files in /etc/hobbit and it started fine
I edited /etc/hobbit/hobbit-clients.cfg and added the following line:
PROC ntpd 1 99 green "TEXT=NTPD is up"
Restarted hobbit, and in a few minutes, it started reporting as expected.
Then I added:
PORT "LOCAL=%(:8888)" TEXT="Gnump is up"
To the same file, (/etc/hobbit/hobbit-clients.cfg) and restared hobbit.
A few minutes later, the ports section started reporting, as expected.
(Though I realize that its a bit off, which I need to fix)
Then I added:
FILE /etc/passwd GREEN NOEXIST track
Reading the documentation inside hobbit-clients.cfg I edited /etc/hobbit/client- local.cfg and added the following line: file:/etc/passwd
restarted hobbit, waited 5 minutes. No luck.
I'm pretty convinced that either:
- the format of the line in /etc/hobbit/client-local.cfg or /etc/hobbit/hobbit-clients.cfg is incorrect, or
- There's something else I need to edit.
-- Josh Luthman Office: 937-552-2340 Direct: 937-552-2343 1100 Wayne St Suite 1337 Troy, OH 45373
Those who don't understand UNIX are condemned to reinvent it, poorly. --- Henry Spencer
On Thursday 01 November 2007, Josh Luthman wrote:
I'm basing my changes on Greg. These still do not work, though I believe they're a step towards the right direction:
#hobbit-clients.cfg HOST=foo.bar.com FILE "/etc/passwd" GREEN NOEXIST TRACK
#client-local.cfg [foo.bar.com] file:/etc/passwd Try file:/etc/passwd:1024
Stef
Made the change and two poll cycles later I'm still boned =(
On 11/1/07, Stef Coene <stef.coene at docum.org> wrote:
On Thursday 01 November 2007, Josh Luthman wrote:
I'm basing my changes on Greg. These still do not work, though I believe they're a step towards the right direction:
#hobbit-clients.cfg HOST=foo.bar.com FILE "/etc/passwd" GREEN NOEXIST TRACK
#client-local.cfg [foo.bar.com] file:/etc/passwd Try file:/etc/passwd:1024
Stef
To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk
-- Josh Luthman Office: 937-552-2340 Direct: 937-552-2343 1100 Wayne St Suite 1337 Troy, OH 45373
Those who don't understand UNIX are condemned to reinvent it, poorly. --- Henry Spencer
check your ghosts report to see if foo.bar.com is reporting in as foo.
And when are you going to change GREEN to "COLOR=green"?
GLH
From: Josh Luthman [mailto:josh at imaginenetworksllc.com]
Sent: Thursday, November 01, 2007 5:13 PM
To: hobbit at hswn.dk
Subject: Re: [hobbit] Re: New to Hobbit --- file monitoring
I'm basing my changes on Greg. These still do not work, thoughI believe they're a step towards the right direction:
#hobbit-clients.cfg
HOST=foo.bar.com
FILE "/etc/passwd" GREEN NOEXIST TRACK
#client-local.cfg
[foo.bar.com]
file:/etc/passwd
I do notice that on my main machine running the server andclient that there is Client Data available if you click on the Files test. There is no client data from the foo.bar.com files test, however. I think my problem right now is that I'm not getting the data from foo.bar.com to BBD. Any ideas at this point?
On 11/1/07, Hubbard, Greg L <greg.hubbard at eds.com> wrote:
Here is something I use that works. This is a "bookend"problem -- both parts have to be done correctly. Hobbit tends to silently ignore errors in configuration files. --------------------------------------------------- In client-local.cfg [myserver.mydomain.com] file:/opt2/log/syslog.log file:/opt2/log/security.log file:/opt2/log/snmptrap.log --------------------------------------------------- in hobbit-clients.cfg HOST=myserver.mydomain.com FILE /opt2/log/syslog.log mtime<600 size<2G TRACK FILE /opt2/log/security.log TRACK FILE /opt2/log/snmptrap.log mtime<600 size<2G TRACK ---------------------------------------------------- Some things to note a) the host names match exactly, and they are not enclosed in double quotes. b) the file names match exactly c) this example is lifted from my running system, with the host name changed to protect the guilty. I have some other examples that use color in the "COLOR=color" format, which I believe is required, but I would have to edit them more before I can post them. d) the client-local.cfg file has some predefined sections in it. Don't use them. Make new ones. Only one section can be applied to a host, so cut and paste will be your friend.
From: Scott Mohnkern [mailto:mohnkern at gmail.com]
Sent: Thursday, November 01, 2007 4:00 PM
To: hobbit at hswn.dk
Subject: Re: [hobbit] Re: New to Hobbit --- filemonitoring
Nope, no joy there either. the man page seemsto think it should be: FILE <full path to file><color> <condition> and that's pretty consistent with the other things I've put into the same file, which come up. I also tried: FILE "/etc/passwd" green noexist TRACK and FILE "/etc/passwd" green noexist Scott On 11/1/07, Hubbard, Greg L <greg.hubbard at eds.com> wrote:
Try this
FILE /etc/passwd noexist COLOR=greenTRACK
From: Scott Mohnkern[mailto:mohnkern at gmail.com] Sent: Thursday, November 01, 2007 3:39 PM To: hobbit at hswn.dk Subject: Re: [hobbit] Re: New to Hobbit --- file monitoring Well, at least its replicatable. Scott On 11/1/07, Scott Mohnkern < mohnkern at gmail.com <mailto:mohnkern at gmail.com> > wrote:
Thanks for the help. I edited/etc/hobbit/hobbit-clients.cfg so the line reads:
FILE /etc/passwd GREEN noexist
still no joy.
Is there anyone on the list that has an
example of a FILE line in their hobbit-clients.cfg file?
On 11/1/07, Hubbard, Greg L <
greg.hubbard at eds.com <mailto:greg.hubbard at eds.com> > wrote:
Try removing the TRACK keyword, and thenchange NOEXIST to lower case. I think Henrik has reported that there are a few bugs in this code, and it is not always clear when case matters and when it doesn't, or when the order of the arguments matters.
From: Scott Mohnkern[mailto:mohnkern at gmail.com] Sent: Thursday, November 01, 2007 3:10 PM To: hobbit at hswn.dk Subject: [hobbit] Re: New to Hobbit --- file monitoring
When all else fails, nuke it and startover. I did an apt-get remove hobbit, and then a dpkg -- purge. Then I removed any files I could find. Then I downloaded the Ubuntu deb file and installed it. It put the configuration files in /etc/hobbit and it started fine I edited /etc/hobbit/hobbit-clients.cfg and added the following line: PROC ntpd 1 99 green "TEXT=NTPD is up" Restarted hobbit, and in a few minutes, it started reporting as expected. Then I added: PORT "LOCAL=%(:8888)" TEXT="Gnump is up" To the same file, (/etc/hobbit/hobbit-clients.cfg) and restared hobbit. A few minutes later, the ports section started reporting, as expected. (Though I realize that its a bit off, which I need to fix) Then I added: FILE /etc/passwd GREEN NOEXIST track Reading the documentation inside hobbit-clients.cfg I edited /etc/hobbit/client- local.cfg and added the following line: file:/etc/passwd restarted hobbit, waited 5 minutes. No luck. I'm pretty convinced that either: 1. the format of the line in /etc/hobbit/client-local.cfg or /etc/hobbit/hobbit-clients.cfg is incorrect, or 2. There's something else I need to edit.
--
Josh Luthman
Office: 937-552-2340
Direct: 937-552-2343
1100 Wayne St
Suite 1337
Troy, OH 45373
Those who don't understand UNIX are condemned to reinvent it,poorly. --- Henry Spencer
Ghost reports doesn't have foo.bar.com but it does have something else - an old hostname that I changed a while back, can you tell me how to fix this?
Greg - making that change didn't fix it. I still have "no files checked" =(
Josh
On 11/1/07, Hubbard, Greg L <greg.hubbard at eds.com> wrote:
check your ghosts report to see if foo.bar.com is reporting in as foo.
And when are you going to change GREEN to "COLOR=green"?
GLH
*From:* Josh Luthman [mailto:josh at imaginenetworksllc.com] *Sent:* Thursday, November 01, 2007 5:13 PM *To:* hobbit at hswn.dk *Subject:* Re: [hobbit] Re: New to Hobbit --- file monitoring
I'm basing my changes on Greg. These still do not work, though I believe they're a step towards the right direction:
#hobbit-clients.cfg HOST=foo.bar.com FILE "/etc/passwd" GREEN NOEXIST TRACK
#client-local.cfg [foo.bar.com] file:/etc/passwd
I do notice that on my main machine running the server and client that there is Client Data available if you click on the Files test. There is no client data from the foo.bar.com files test, however. I think my problem right now is that I'm not getting the data from foo.bar.com to BBD. Any ideas at this point?
On 11/1/07, Hubbard, Greg L <greg.hubbard at eds.com> wrote:
Here is something I use that works. This is a "bookend" problem -- both parts have to be done correctly. Hobbit tends to silently ignore errors in configuration files.
In client-local.cfg
[myserver.mydomain.com] file:/opt2/log/syslog.log file:/opt2/log/security.log file:/opt2/log/snmptrap.log
in hobbit-clients.cfg
HOST=myserver.mydomain.com FILE /opt2/log/syslog.log mtime<600 size<2G TRACK FILE /opt2/log/security.log TRACK FILE /opt2/log/snmptrap.log mtime<600 size<2G TRACK
Some things to note
a) the host names match exactly, and they are not enclosed in double quotes.
b) the file names match exactly
c) this example is lifted from my running system, with the host name changed to protect the guilty. I have some other examples that use color in the "COLOR=color" format, which I believe is required, but I would have to edit them more before I can post them.
d) the client-local.cfg file has some predefined sections in it. Don't use them. Make new ones. Only one section can be applied to a host, so cut and paste will be your friend.
*From:* Scott Mohnkern [mailto:mohnkern at gmail.com] *Sent:* Thursday, November 01, 2007 4:00 PM *To:* hobbit at hswn.dk *Subject:* Re: [hobbit] Re: New to Hobbit --- file monitoring
Nope, no joy there either. the man page seems to think it should be:
FILE <full path to file><color> <condition>
and that's pretty consistent with the other things I've put into the same file, which come up.
I also tried:
FILE "/etc/passwd" green noexist TRACK
and
FILE "/etc/passwd" green noexist
Scott
On 11/1/07, Hubbard, Greg L <greg.hubbard at eds.com> wrote:
Try this
FILE /etc/passwd noexist COLOR=green TRACK
*From:* Scott Mohnkern [mailto:mohnkern at gmail.com] *Sent:* Thursday, November 01, 2007 3:39 PM *To:* hobbit at hswn.dk *Subject:* Re: [hobbit] Re: New to Hobbit --- file monitoring
Well, at least its replicatable.
Scott
On 11/1/07, Scott Mohnkern < mohnkern at gmail.com> wrote:
Thanks for the help. I edited /etc/hobbit/hobbit-clients.cfg so the line reads:
FILE /etc/passwd GREEN noexist
still no joy.
Is there anyone on the list that has an example of a FILE line in their hobbit-clients.cfg file?
On 11/1/07, Hubbard, Greg L < greg.hubbard at eds.com> wrote:
Try removing the TRACK keyword, and then change NOEXIST to lower case. I think Henrik has reported that there are a few bugs in this code,
and it is not always clear when case matters and when it doesn't, or when the order of the arguments matters.
*From:* Scott Mohnkern [mailto:mohnkern at gmail.com] *Sent:* Thursday, November 01, 2007 3:10 PM *To:* hobbit at hswn.dk *Subject:* [hobbit] Re: New to Hobbit --- file monitoring
When all else fails, nuke it and start over. I did an apt-get remove hobbit, and then a dpkg -- purge. Then I removed any files I could find. Then I downloaded the Ubuntu deb file and installed it. It put the configuration files in /etc/hobbit and it started fine
I edited /etc/hobbit/hobbit-clients.cfg and added the following line:
PROC ntpd 1 99 green "TEXT=NTPD is up"
Restarted hobbit, and in a few minutes, it started reporting as expected.
Then I added:
PORT "LOCAL=%(:8888)" TEXT="Gnump is up"
To the same file, (/etc/hobbit/hobbit-clients.cfg) and restared hobbit.
A few minutes later, the ports section started reporting, as expected.
(Though I realize that its a bit off, which I need to fix)
Then I added:
FILE /etc/passwd GREEN NOEXIST track
Reading the documentation inside hobbit-clients.cfg I edited /etc/hobbit/client- local.cfg and added the following line: file:/etc/passwd
restarted hobbit, waited 5 minutes. No luck.
I'm pretty convinced that either:
- the format of the line in /etc/hobbit/client-local.cfg or /etc/hobbit/hobbit-clients.cfg is incorrect, or
- There's something else I need to edit.
-- Josh Luthman Office: 937-552-2340 Direct: 937-552-2343 1100 Wayne St Suite 1337 Troy, OH 45373
Those who don't understand UNIX are condemned to reinvent it, poorly. --- Henry Spencer
-- Josh Luthman Office: 937-552-2340 Direct: 937-552-2343 1100 Wayne St Suite 1337 Troy, OH 45373
Those who don't understand UNIX are condemned to reinvent it, poorly. --- Henry Spencer
Well, well. A "ghost" is a Hobbit client reporting in with a name that is not in the bb-hosts file.
Two ways to fix it.
a) on the client, there is a way to make the client use an arbitrary name. I think it is the "--client foo.bar.com" option, but I could be wrong.
b) on the server, you can add a "client:wrong.host.name" entry for the client that is reporting in with a bad name.
I could be wrong on both counts about the syntax -- you can check the man pages.
From: Josh Luthman [mailto:josh at imaginenetworksllc.com]
Sent: Thursday, November 01, 2007 8:45 PM
To: hobbit at hswn.dk
Subject: Re: [hobbit] Re: New to Hobbit --- file monitoring
Ghost reports doesn't have foo.bar.com but it does havesomething else - an old hostname that I changed a while back, can you tell me how to fix this?
Greg - making that change didn't fix it. I still have "no fileschecked" =(
Josh
On 11/1/07, Hubbard, Greg L <greg.hubbard at eds.com> wrote:
check your ghosts report to see if foo.bar.com isreporting in as foo. And when are you going to change GREEN to "COLOR=green"? GLH
From: Josh Luthman[mailto:josh at imaginenetworksllc.com] Sent: Thursday, November 01, 2007 5:13 PM To: hobbit at hswn.dk Subject: Re: [hobbit] Re: New to Hobbit --- file monitoring
I'm basing my changes on Greg. These still donot work, though I believe they're a step towards the right direction: #hobbit-clients.cfg HOST=foo.bar.com FILE "/etc/passwd" GREEN NOEXIST TRACK #client-local.cfg [foo.bar.com] file:/etc/passwd I do notice that on my main machine running the server and client that there is Client Data available if you click on the Files test. There is no client data from the foo.bar.com files test, however. I think my problem right now is that I'm not getting the data from foo.bar.com to BBD. Any ideas at this point? On 11/1/07, Hubbard, Greg L <greg.hubbard at eds.com> wrote:
Here is something I use that works.This is a "bookend" problem -- both parts have to be done correctly. Hobbit tends to silently ignore errors in configuration files.
In client-local.cfg
[myserver.mydomain.com]
file:/opt2/log/syslog.log
file:/opt2/log/security.log
file:/opt2/log/snmptrap.log
in hobbit-clients.cfg
HOST=myserver.mydomain.com
FILE /opt2/log/syslog.logmtime<600 size<2G TRACK FILE /opt2/log/security.log TRACK FILE /opt2/log/snmptrap.log mtime<600 size<2G TRACK
Some things to note
a) the host names match exactly, andthey are not enclosed in double quotes. b) the file names match exactly c) this example is lifted from my running system, with the host name changed to protect the guilty. I have some other examples that use color in the "COLOR=color" format, which I believe is required, but I would have to edit them more before I can post them. d) the client-local.cfg file has some predefined sections in it. Don't use them. Make new ones. Only one section can be applied to a host, so cut and paste will be your friend.
From: Scott Mohnkern[mailto:mohnkern at gmail.com] Sent: Thursday, November 01, 2007 4:00 PM To: hobbit at hswn.dk Subject: Re: [hobbit] Re: New to Hobbit --- file monitoring
Nope, no joy there either. the man pageseems to think it should be: FILE <full path to file><color> <condition> and that's pretty consistent with the other things I've put into the same file, which come up. I also tried: FILE "/etc/passwd" green noexist TRACK and FILE "/etc/passwd" green noexist Scott On 11/1/07, Hubbard, Greg L <greg.hubbard at eds.com > wrote:
Try this
FILE /etc/passwd noexist COLOR=greenTRACK
From: Scott Mohnkern[mailto:mohnkern at gmail.com] Sent: Thursday, November 01, 2007 3:39 PM To: hobbit at hswn.dk Subject: Re: [hobbit] Re: New to Hobbit --- file monitoring Well, at least its replicatable. Scott On 11/1/07, Scott Mohnkern < mohnkern at gmail.com <mailto:mohnkern at gmail.com> > wrote:
Thanks for the help. I edited/etc/hobbit/hobbit-clients.cfg so the line reads:
FILE /etc/passwd GREEN noexist
still no joy.
Is there anyone on the list that has an
example of a FILE line in their hobbit-clients.cfg file?
On 11/1/07, Hubbard, Greg L <
greg.hubbard at eds.com <mailto:greg.hubbard at eds.com> > wrote:
Try removing the TRACK keyword, and thenchange NOEXIST to lower case. I think Henrik has reported that there are a few bugs in this code, and it is not always clear when case matters and when it doesn't, or when the order of the arguments matters.
From: Scott Mohnkern[mailto:mohnkern at gmail.com] Sent: Thursday, November 01, 2007 3:10 PM To: hobbit at hswn.dk Subject: [hobbit] Re: New to Hobbit --- file monitoring
When all else fails, nuke it and startover. I did an apt-get remove hobbit, and then a dpkg -- purge. Then I removed any files I could find. Then I downloaded the Ubuntu deb file and installed it. It put the configuration files in /etc/hobbit and it started fine I edited /etc/hobbit/hobbit-clients.cfg and added the following line: PROC ntpd 1 99 green "TEXT=NTPD is up" Restarted hobbit, and in a few minutes, it started reporting as expected. Then I added: PORT "LOCAL=%(:8888)" TEXT="Gnump is up" To the same file, (/etc/hobbit/hobbit-clients.cfg) and restared hobbit. A few minutes later, the ports section started reporting, as expected. (Though I realize that its a bit off, which I need to fix) Then I added: FILE /etc/passwd GREEN NOEXIST track Reading the documentation inside hobbit-clients.cfg I edited /etc/hobbit/client- local.cfg and added the following line: file:/etc/passwd restarted hobbit, waited 5 minutes. No luck. I'm pretty convinced that either: 1. the format of the line in /etc/hobbit/client-local.cfg or /etc/hobbit/hobbit-clients.cfg is incorrect, or 2. There's something else I need to edit.
--
Josh Luthman
Office: 937-552-2340
Direct: 937-552-2343
1100 Wayne St
Suite 1337
Troy, OH 45373
Those who don't understand UNIX are condemned toreinvent it, poorly. --- Henry Spencer
--
Josh Luthman
Office: 937-552-2340
Direct: 937-552-2343
1100 Wayne St
Suite 1337
Troy, OH 45373
Those who don't understand UNIX are condemned to reinvent it,poorly. --- Henry Spencer
That's what I was missing (and was entirely unclear in the documentation. I knew I had to have an entry in both files, but didn't realize that I needed a hostname definition in both places.
For purposes of completeness in documentation:
127,.0.0.1 and localhost do not in fact work for myserver.mydomain.name, however, the host name (from /etc/hostname) does.
Now that I know that it's actually checking it, I just need to set the rules on it, which should be straightforward.
Thanks!
Scott
On 11/1/07, Hubbard, Greg L <greg.hubbard at eds.com> wrote:
Here is something I use that works. This is a "bookend" problem -- both parts have to be done correctly. Hobbit tends to silently ignore errors in configuration files.
In client-local.cfg
[myserver.mydomain.com] file:/opt2/log/syslog.log file:/opt2/log/security.log file:/opt2/log/snmptrap.log
in hobbit-clients.cfg
HOST=myserver.mydomain.com FILE /opt2/log/syslog.log mtime<600 size<2G TRACK FILE /opt2/log/security.log TRACK FILE /opt2/log/snmptrap.log mtime<600 size<2G TRACK
Some things to note
a) the host names match exactly, and they are not enclosed in double quotes.
b) the file names match exactly
c) this example is lifted from my running system, with the host name changed to protect the guilty. I have some other examples that use color in the "COLOR=color" format, which I believe is required, but I would have to edit them more before I can post them.
d) the client-local.cfg file has some predefined sections in it. Don't use them. Make new ones. Only one section can be applied to a host, so cut and paste will be your friend.
*From:* Scott Mohnkern [mailto:mohnkern at gmail.com] *Sent:* Thursday, November 01, 2007 4:00 PM *To:* hobbit at hswn.dk *Subject:* Re: [hobbit] Re: New to Hobbit --- file monitoring
Nope, no joy there either. the man page seems to think it should be:
FILE <full path to file><color> <condition>
and that's pretty consistent with the other things I've put into the same file, which come up.
I also tried:
FILE "/etc/passwd" green noexist TRACK
and
FILE "/etc/passwd" green noexist
Scott
On 11/1/07, Hubbard, Greg L <greg.hubbard at eds.com> wrote:
Try this
FILE /etc/passwd noexist COLOR=green TRACK
*From:* Scott Mohnkern [mailto:mohnkern at gmail.com] *Sent:* Thursday, November 01, 2007 3:39 PM *To:* hobbit at hswn.dk *Subject:* Re: [hobbit] Re: New to Hobbit --- file monitoring
Well, at least its replicatable.
Scott
On 11/1/07, Scott Mohnkern < mohnkern at gmail.com> wrote:
Thanks for the help. I edited /etc/hobbit/hobbit-clients.cfg so the line reads:
FILE /etc/passwd GREEN noexist
still no joy.
Is there anyone on the list that has an example of a FILE line in their hobbit-clients.cfg file?
On 11/1/07, Hubbard, Greg L < greg.hubbard at eds.com> wrote:
Try removing the TRACK keyword, and then change NOEXIST to lower case. I think Henrik has reported that there are a few bugs in this code, and it is not always clear when case matters and when it doesn't, or when the order of the arguments matters.
*From:* Scott Mohnkern [mailto:mohnkern at gmail.com] *Sent:* Thursday, November 01, 2007 3:10 PM *To:* hobbit at hswn.dk *Subject:* [hobbit] Re: New to Hobbit --- file monitoring
When all else fails, nuke it and start over. I did an apt-get remove hobbit, and then a dpkg -- purge. Then I removed any files I could find. Then I downloaded the Ubuntu deb file and installed it. It put the configuration files in /etc/hobbit and it started fine
I edited /etc/hobbit/hobbit-clients.cfg and added the following line:
PROC ntpd 1 99 green "TEXT=NTPD is up"
Restarted hobbit, and in a few minutes, it started reporting as expected.
Then I added:
PORT "LOCAL=%(:8888)" TEXT="Gnump is up"
To the same file, (/etc/hobbit/hobbit-clients.cfg) and restared hobbit.
A few minutes later, the ports section started reporting, as expected.
(Though I realize that its a bit off, which I need to fix)
Then I added:
FILE /etc/passwd GREEN NOEXIST track
Reading the documentation inside hobbit-clients.cfg I edited /etc/hobbit/client- local.cfg and added the following line: file:/etc/passwd
restarted hobbit, waited 5 minutes. No luck.
I'm pretty convinced that either:
- the format of the line in /etc/hobbit/client-local.cfg or /etc/hobbit/hobbit-clients.cfg is incorrect, or
- There's something else I need to edit.
participants (5)
-
bgmilne＠staff.telkomsa.net
-
greg.hubbard＠eds.com
-
josh＠imaginenetworksllc.com
-
mohnkern＠gmail.com
-
stef.coene＠docum.org