Re: [logs] swatchrc emailing works!!!!

From: swatch swatch (swatch_5at_private)
Date: Tue Jan 07 2003 - 07:37:06 PST

  • Next message: Balazs Scheidler: "Re: [logs] EventLog library"

    Well I finally came up with something that sends emails to my account based 
    on what I have in my swatchrc file.  It is a combination of the responses 
    i've received since joining this mailing list.
    Here is my mail field for failed logon attempts:
    # Bad login attempts
    watchfor        /Failed/
                    echo bold
                    exec echo $0 | mail -s 'Authentication Failure' 
    I start SWATCH by running the command:
    /usr/local/bin/swatch -c /var/log/swatchrc -t /var/log/messages --daemon
    I tested by typing in the wrong password while trying to connect to the 
    server via SSH.  After a few seconds i have a message from root with subject 
    line 'Authentication Failure' and the log file in the body of the message.  
    I will now configure the rest of my swatchrc file since i know what works 
    for me.
    Thanks to everyone for their help!!
    STOP MORE SPAM with the new MSN 8 and get 2 months FREE*
    LogAnalysis mailing list

    This archive was generated by hypermail 2b30 : Wed Jan 08 2003 - 09:22:12 PST