FILE monitor and mtime<600 troubleshooting
Hi,
I'm running Hobbit 4.2.0 with the allinone patch on hpux and can't get the FILE monitor to work. I've added the required file: entry in the client-local.cfg for the host, then put the FILE directive in the hobbit-clients.cfg file. After adding the monitor, the BBDISPLAY picks up the new file and shows it as 'green'. When testing the monitor by changing the mtime of my file, hobbit doesn't alert on the change.
Here's my hobbit-client.cfg entry:
CLASS=classname FILE /etc/sudoers yellow mtime<600
The client-local.cfg entry:
[classname] file:/etc/sudoers
Has anyone else seen this before or have any advice on how to troubleshoot?
Thanks,
Denver Osborn
What your OS ? I and some one else have had problems too, me Sol 2.9 they on Sol 10.
Work on a different hobbit install under Sol 2.8 . Denver Osborn wrote:
Hi,
I'm running Hobbit 4.2.0 with the allinone patch on hpux and can't get the FILE monitor to work. I've added the required file: entry in the client-local.cfg for the host, then put the FILE directive in the hobbit-clients.cfg file. After adding the monitor, the BBDISPLAY picks up the new file and shows it as 'green'. When testing the monitor by changing the mtime of my file, hobbit doesn't alert on the change.
Here's my hobbit-client.cfg entry:
CLASS=classname
FILE /etc/sudoers yellow mtime<600The client-local.cfg entry:
[classname]
file:/etc/sudoers
Has anyone else seen this before or have any advice on how to troubleshoot?
Thanks,
Denver Osborn
Well, I use HOST=hostname in hobbit-client.cfg instead of CLASS=classname, and then in client-local.cfg I use [hostname] instead of classname. And it works on my Solaris 9 systems.
One caveat is that the Hobbit agent must be able to read the file -- is /etc/sudoers readable?
Finally, you can look at the client data returned by the agent for this host and see what is being returned for these files. This can help you decide whether the problem is in the client-local.cfg part (which tells the remote agent what to watch) or the hobbit-client.cfg (which tells the server what to do with the data returned by the the Hobbit agent).
GLH
From: Denver Osborn [mailto:denver at fni-stl.com]
Sent: Friday, July 18, 2008 7:36 AM
To: hobbit at hswn.dk
Subject: [hobbit] FILE monitor and mtime<600 troubleshooting
Hi,
I'm running Hobbit 4.2.0 with the allinone patch on hpux andcan't get the FILE monitor to work. I've added the required file: entry in the client-local.cfg for the host, then put the FILE directive in the hobbit-clients.cfg file. After adding the monitor, the BBDISPLAY picks up the new file and shows it as 'green'. When testing the monitor by changing the mtime of my file, hobbit doesn't alert on the change.
Here's my hobbit-client.cfg entry:
CLASS=classname
FILE /etc/sudoers yellow mtime<600
The client-local.cfg entry:
[classname]
file:/etc/sudoers
Has anyone else seen this before or have any advice on how totroubleshoot?
Thanks,
Denver Osborn
I'm running Hobbit 4.2.0 with the allinone patch on hpux and can't get the FILE monitor to work. I've added the required file: entry in the client-local.cfg for the host, then put the FILE directive in the hobbit-clients.cfg file. After adding the monitor, the BBDISPLAY picks up the new file and shows it as 'green'. When testing the monitor by changing the mtime of my file, hobbit doesn't alert on the change.
Here's my hobbit-client.cfg entry:
CLASS=classname FILE /etc/sudoers yellow mtime<600
I was able to solve this one by changing "CLASS=" to "HOSTCLASS=" in the hobbit-clients.cfg. Once I did that everything worked as expected.
I'm running Hobbit 4.2.0 with the allinone patch on hpux and can't get the FILE monitor to work. I've added the required file: entry in the client-local.cfg for the host, then put the FILE directive in the hobbit-clients.cfg file. After adding the monitor, the BBDISPLAY picks up the new file and shows it as 'green'. When testing the monitor by changing the mtime of my file, hobbit doesn't alert on the change.
Here's my hobbit-client.cfg entry:
CLASS=classname FILE /etc/sudoers yellow mtime<600
I was able to solve this one by changing "CLASS=" to "HOSTCLASS=" in the hobbit-clients.cfg. Once I did that everything worked as expected.
Sorry, spoke too soon. I didn't wait long enough between hobbit-clients.cfg changes. HOSTCLASS= did nothing and isn't valid syntax. A change prior to HOSTCLASS= was HOST=hostname and that's what solved it. Not sure why, but I can't get it to pick up with the CLASS=classname entry.
Sorry if this is obvious but have you tried this using just the HOST=hostname to make sure it is working?
Robert
-----Original Message----- From: Denver Osborn [mailto:denver at fni-stl.com] Sent: Monday, July 21, 2008 6:10 PM To: hobbit at hswn.dk Subject: RE: [hobbit] FILE monitor and mtime<600 troubleshooting
I'm running Hobbit 4.2.0 with the allinone patch on hpux and can't get the FILE monitor to work. I've added the required file: entry in the client-local.cfg for the host, then put the FILE directive in the hobbit-clients.cfg file. After adding the monitor, the BBDISPLAY picks up the new file and shows it as 'green'. When testing the monitor by changing the mtime of my file, hobbit doesn't alert on the change.
Here's my hobbit-client.cfg entry:
CLASS=classname FILE /etc/sudoers yellow mtime<600
I was able to solve this one by changing "CLASS=" to "HOSTCLASS=" in the hobbit-clients.cfg. Once I did that everything worked as expected.
Sorry, spoke too soon. I didn't wait long enough between hobbit- clients.cfg changes. HOSTCLASS= did nothing and isn't valid syntax. A change prior to HOSTCLASS= was HOST=hostname and that's what solved it. Not sure why, but I can't get it to pick up with the CLASS=classname entry.
To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk
Sorry if this is obvious but have you tried this using just the HOST=hostname to make sure it is working?
Thanks, I did that and all works well with HOST=hostname. The one thing I couldn't get working is CLASS=classname. Using the CLASS=classname entry makes more sense for file monitoring as the same file in different platforms vary in permissions and location. If I can't make it work with CLASS I'll stick with what works by maintaining multiple HOST entries.
The configs once again are
hobbit-clients.cfg:
CLASS=hpux11iv1 FILE /etc/sudoers mtime>600
client-local.cfg:
[hpux11iv1] file:/etc/sudoers
bb-hosts
0.0.0.0 hpux_host # CLASS:hpux11iv1
-denver
Have you tried placing the lines at the very top of the file or at the very bottom?
I had a problem with the client-local.cfg file where I had put the hostname of the same class after the class name which was empty. Nothing worked. Once there is a hit, hostname or class, it stops processing. So it seems that you cannot expect hostname commands and class name commands to both execute; which ever it finds first it executes those commands and then stops. At least that is what I have found.
Robert
-----Original Message----- From: Denver Osborn [mailto:denver at fni-stl.com] Sent: Tuesday, July 22, 2008 9:08 AM To: hobbit at hswn.dk Subject: RE: [hobbit] FILE monitor and mtime<600 troubleshooting
Sorry if this is obvious but have you tried this using just the HOST=hostname to make sure it is working?
Thanks, I did that and all works well with HOST=hostname. The one thing I couldn't get working is CLASS=classname. Using the CLASS=classname entry makes more sense for file monitoring as the same file in different platforms vary in permissions and location. If I can't make it work with CLASS I'll stick with what works by maintaining multiple HOST entries.
The configs once again are
hobbit-clients.cfg:
CLASS=hpux11iv1 FILE /etc/sudoers mtime>600
client-local.cfg:
[hpux11iv1] file:/etc/sudoers
bb-hosts
0.0.0.0 hpux_host # CLASS:hpux11iv1
-denver
To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk
I think that is what I found as well, so I bagged the class stuff altogether and went with only host names. And I refreshed my memory on how to cut and paste in my text editor...
GLH
-----Original Message----- From: McGraw, Robert P [mailto:rmcgraw at purdue.edu] Sent: Tuesday, July 22, 2008 12:37 PM To: hobbit at hswn.dk Subject: RE: [hobbit] FILE monitor and mtime<600 troubleshooting
Have you tried placing the lines at the very top of the file or at the very bottom?
I had a problem with the client-local.cfg file where I had put the hostname of the same class after the class name which was empty. Nothing worked. Once there is a hit, hostname or class, it stops processing. So it seems that you cannot expect hostname commands and class name commands to both execute; which ever it finds first it executes those commands and then stops. At least that is what I have found.
Robert
-----Original Message----- From: Denver Osborn [mailto:denver at fni-stl.com] Sent: Tuesday, July 22, 2008 9:08 AM To: hobbit at hswn.dk Subject: RE: [hobbit] FILE monitor and mtime<600 troubleshooting
Sorry if this is obvious but have you tried this using just the HOST=hostname to make sure it is working?
Thanks, I did that and all works well with HOST=hostname. The one thing I couldn't get working is CLASS=classname. Using the CLASS=classname entry makes more sense for file monitoring as the same
file in different platforms vary in permissions and location. If I can't make it work with CLASS I'll stick with what works by maintaining multiple HOST entries.
The configs once again are
hobbit-clients.cfg:
CLASS=hpux11iv1 FILE /etc/sudoers mtime>600
client-local.cfg:
[hpux11iv1] file:/etc/sudoers
bb-hosts
0.0.0.0 hpux_host # CLASS:hpux11iv1
-denver
To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk
I have had problems with the placement of thing in the .cfg files.
Try moving the lines to the very top of the before anything else. This will let you know if any of the other entries are causing problem.
At one time I had an empty class name before a hostname of the same class and nothing worked. When I moved the host name above all the class names it started working.
Robert
From: Denver Osborn [mailto:denver at fni-stl.com] Sent: Friday, July 18, 2008 8:36 AM To: hobbit at hswn.dk Subject: [hobbit] FILE monitor and mtime<600 troubleshooting
Hi,
I'm running Hobbit 4.2.0 with the allinone patch on hpux and can't get the FILE monitor to work. I've added the required file: entry in the client-local.cfg for the host, then put the FILE directive in the hobbit-clients.cfg file. After adding the monitor, the BBDISPLAY picks up the new file and shows it as 'green'. When testing the monitor by changing the mtime of my file, hobbit doesn't alert on the change.
Here's my hobbit-client.cfg entry:
CLASS=classname
FILE /etc/sudoers yellow mtime<600The client-local.cfg entry:
[classname]
file:/etc/sudoers
Has anyone else seen this before or have any advice on how to troubleshoot?
Thanks,
Denver Osborn
I have had problems with the placement of thing in the .cfg files.
Try moving the lines to the very top of the before anything else. This will let you know if any of the other entries are causing problem.
At one time I had an empty class name before a hostname of the same class and nothing worked. When I moved the host name above all the class names it started working.
Robert I'm going to move my hobbit-clients.cfg and client-local.cfg entries for the monitor and test.
My OS is HP-UX 11.31 on the server and 11.11 on the client. The sudoers file permissions are 440 bin:bin, but the file monitor does have stats available on the bbdisplay. Regardless, I'm testing with a world readable file too.
Here's what gets reported to the server from the client.
[file:/opt/iexpress/sudo/etc/sudoers] type:100000 (file) mode:440 (-r--r-----) linkcount:1 owner:2 (bin) group:2 (bin) size:7076 clock:1216388957 (2008/07/18-08:49:17) atime:1216388812 (2008/07/18-08:46:52) ctime:1216388812 (2008/07/18-08:46:52) mtime:1216388812 (2008/07/18-08:46:52)
[file:/etc/sudoers.test] type:100000 (file) mode:444 (-r--r--r--) linkcount:1 owner:2 (bin) group:2 (bin) size:7066 clock:1216388957 (2008/07/18-08:49:17) atime:1216385983 (2008/07/18-07:59:43) ctime:1216385990 (2008/07/18-07:59:50) mtime:1216385990 (2008/07/18-07:59:50)
participants (4)
-
denver＠fni-stl.com
-
greg.hubbard＠eds.com
-
michael.nemeth＠lmco.com
-
rmcgraw＠purdue.edu