Re: [logs] swatchrc emailing works!!!!

Previous message: Eric Fitzgerald: "RE: [logs] Windows Event Log Analysis"
Next in thread: Jeremy Mates: "[logs] Re: swatchrc emailing works!!!!"
Reply: Jeremy Mates: "[logs] Re: swatchrc emailing works!!!!"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

swatch_5at_private

Well I finally came up with something that sends emails to my account based 
on what I have in my swatchrc file.  It is a combination of the responses 
i've received since joining this mailing list.

Here is my mail field for failed logon attempts:

# Bad login attempts
watchfor        /Failed/
                echo bold
                exec echo $0 | mail -s 'Authentication Failure' 
meat_private

I start SWATCH by running the command:

/usr/local/bin/swatch -c /var/log/swatchrc -t /var/log/messages --daemon

I tested by typing in the wrong password while trying to connect to the 
server via SSH.  After a few seconds i have a message from root with subject 
line 'Authentication Failure' and the log file in the body of the message.  
I will now configure the rest of my swatchrc file since i know what works 
for me.

Thanks to everyone for their help!!

_________________________________________________________________
STOP MORE SPAM with the new MSN 8 and get 2 months FREE* 
http://join.msn.com/?page=features/junkmail

_______________________________________________
LogAnalysis mailing list
LogAnalysisat_private
http://lists.shmoo.com/mailman/listinfo/loganalysis