Hi,
I am trying to monitor files which should NOT be modified.
If have the MTIME parameter setup as follows:
FILE /etc/passwd TYPE=file OWNER=0 GROUP=0 MODE=644 MTIME>86400 red
This basically means that if the file is modified within the last 24 hours, it should go red...
It never goes to any other status other than green.
I also have the /etc/passwd entry in the clients-local.cfg file as well\
Any Ideas?
So Ive solved my own problem...
For some reason, the order in whchi you specify tags in the hobbit-client.cfg matters....
My original line was as follows:
FILE /etc/passwd TYPE=file OWNER=0 GROUP=0 MODE=644 MTIME>360 red
The one that works is
FILE /etc/passwd TYPE=file MODE=644 MTIME>360 OWNER=0 GROUP=0 red
The only change was putting the OWNER and GROUP attributes at the end...once there it worked like a charm..
Can anybody explain this?
Hi,
maybe you want to add MD5 to your file section? FILE /etc/passwd MD5=<value from md5 /etc/passwd> This covers every change
greetings Rolf Schrittenlocher
So Ive solved my own problem...
For some reason, the order in whchi you specify tags in the hobbit-client.cfg matters....
My original line was as follows:
FILE /etc/passwd TYPE=file OWNER=0 GROUP=0 MODE=644 MTIME>360 red
The one that works is
FILE /etc/passwd TYPE=file MODE=644 MTIME>360 OWNER=0 GROUP=0 red
The only change was putting the OWNER and GROUP attributes at the end...once there it worked like a charm..
Can anybody explain this?
-- Mit freundlichen Gruessen Rolf Schrittenlocher
Bitte beachten Sie die neue Emailadresse!
HeBIS-IT, Senckenberganlage 31, 60054 Frankfurt Tel: (49) 69 - 798 28908 Fax: (49) 69 798 28817 LBS: lbs-f at mlist.uni-frankfurt.de Persoenlich: schritte at hebis.uni-frankfurt.de
Yes but that would require me to change the MD5 hash everytime the file changes...This would take alot of effort across 100 servers....
THe MTIME is ok because i can reset the alert and still get notified...
Michael S. Fisher ISD | Active Directory Support mfisher at hra.com +1 310 781 5663
participants (2)
-
MFisher＠hra.com
-
schritte＠hebis.uni-frankfurt.de