Re: [logs] swatchrc file

From: swatch swatch (swatch_5at_private)
Date: Fri Jan 17 2003 - 10:49:28 PST

  • Next message: Rainer Gerhards: "RE: [logs] RE: NT Event Log and Web Server Attacks"

    I now face another challenge with swatch.
    1. I want swatch to start automatically should the server be rebooted for 
    some reason.  This is the command i use to start swatch manually:
    # /usr/local/bin/swatch -c /var/log/swatchrc -t /var/log/messages --daemon
    Where would i put this command so that it starts swatch automatically.  Do i 
    have to create a shell script or something?  If so, what is the proper 
    2. I have setup one swatchrc file but i have 7 instances of swatch running 
    to look in separate log files (based on how i have syslog.conf setup in 
    redhat 7.2).  This includes 3 facilities I created (local0 through local2).
    What i want to do is setup 7 swatchrc files.  One swatchrc file for every 
    logfile.  Is this possible?  If so, do i just name my swatchrc files 
    swatchrc1 through swatchrc7 and configure each one to look for specific 
    information depending on what logfile it is pointed at?  For example, if i 
    have swatchrc1 setup to look in /var/log/kernel and swatchrc2 to look in 
    /var/log/messages would these be my startup scripts (remember i want to put 
    these scripts somewhere where they will start automatically should the 
    server be rebooted).
    # /usr/local/bin/swatch -c /var/log/swatchrc1 -t /var/log/kernel --daemon
    # /usr/local/bin/swatch -c /var/log/swatchrc2 -t /var/log/messages --daemon
    All help is appreciated.  Thanks!
    Protect your PC - get VirusScan Online
    LogAnalysis mailing list

    This archive was generated by hypermail 2b30 : Sat Jan 18 2003 - 21:18:12 PST