[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

edit schemes in master config file



I'm having trouble getting an "editscheme" to work that is defined in
my /etc/multitail.conf file.

Version: Ubuntu 11.10 multitail package, multitail 5.2.8 (changelog on
www.vanheusden.com/multitail/changelog.html is out of date)

Error:
Error while processing configuration file at line 1200:
Edit scheme 'firewall' is unknown: you must first define a
filterscheme before you can use it.


Here is my relevant config in multitail.conf:


editscheme:firewall:simplifies output
editrule:ke:\[IPT\]
editrule:ke:kernel\:
editrule:ke:MAC=..:..:..:..:..:..:..:..:..:..:..:..:..:..
editrule:ke:\[[0-9]{6}.[0-9]{6}\]
editrule:ke:IN=eth[0-9]
editrule:ke:OUT=eth[0-9]
editrule:kc:" ":1
editrule:kc:" ":0
editrule:ke:TOS=0x00
editrule:ke:DF
editrule:ke:PREC=0x00
editrule:ke:RES=0x00
editrule:ke:URGP=[0-9]

useeditscheme:firewall:/var/log/iptables.log



I've tried putting my "useeditscheme" line before and after the
editscheme definition, with no luck. The error says I need to create a
"filterscheme" which doesn't make sense to me, since I'm defining and
using an "editscheme". I've tried defining a stub filterscheme without
any rules in it and that didn't do anything either.

I'm guessing this is a bug? Ubuntu seems to be one version behind
(5.2.9 is the latest) so I don't know if this is fixed in the latest
version.

I've also tried starting multitail with the "-ks firewall" option, and
it just keeps complaining that no "firewall" scheme can be found. I've
tried removing my .deb, compiling and installing the latest 5.2.9
version from source, but I still have the same problem. Color schemes
work fine for me. Just not the edit schemes.

Thanks!
-Miles