SWATCH++.CONF(5)

NAME
swatch++.conf - SOS's log watcher configuration file

SYNOPSIS
/etc/swatch++.conf

DESCRIPTION
The is the configuration file for swatch++ It can contain two types of lines, an eval line which can define the actions to be taken and a match line which specifies the regular expression to match, the threshhold, the rate limitation, and the action to be taken.

EVAL LINES
eval lines are exactly that. Lines which are supposed to be `eval`ed by perl5. Usually they are used to define various subroutines which are used in the action field. This could range from ringing the terminal bell to sending mail.

Examples:
######################################################################
# Define a few variables
#
eval chop($hostname = `/bin/hostname`);
eval $History_nument = 0; @History_ara = ();
eval $SENDMAIL_headers = "From: Swatch++ Log Monitor <root>\nTo: Interested Parties <nobody>\nSubject: Log Alert ($hostname)\n\n";
eval $SENDMAIL_footers = "\n\n----------------------------------------------------------------------\n\nThe first line was responsible for generating this error message.\nSubsequent lines involve older alerts of varying degrees of severity\nprovided for informational purposes.  Any specific details provided on\nany given are usually only applicable to the last message matching the\nrule--precursers may or may not involve the information given.\n\nFor full information, please review the real system logs.\n\n";
######################################################################
# Defined subroutines
#
############################################################
# Keep track of last 25 messages for histerical porpoises
#
eval sub AddHistory { my($message) = @_; if ($History_nument < 25) { $History_nument++; } else { pop(@History_ara); } unshift(@History_ara,$message); }
eval sub ListHistory { my($count) = @_; my $x; my @R; my $top = (($count < $#History_ara) ? $count : $#History_ara); for ($x=0;$x <= $top; $x++) { push(@R,$History_ara[$x]); } @R; }
############################################################
# I/O routines
#
########################################
# sendmail
#
eval sub Sendmail { my($to, @stuff) = @_; open(SENDMAIL,"|/usr/lib/sendmail -odb -oem -os -oi $to"); print SENDMAIL $SENDMAIL_headers; print SENDMAIL join("\n",@stuff) . "\n"; print SENDMAIL $SENDMAIL_footers; close(SENDMAIL); }
########################################
# Printing
#
eval sub Print { my($message) = @_; my $foo="$realdate $host $message"; &AddHistory($foo); print "$foo\n"; }
##################################################
# Mail messages (calls sendmail with history)
eval sub Mail { my($to,$message) = @_; my $foo="$realdate $host $message"; &AddHistory($foo); &Sendmail($to,&ListHistory(25)); }
#
#
######################################################################

MATCH LINES
Match lines are lines which define what to look for and what to do when you found them. They are comprised of five field, seperated by colon (:).

regular expression
    The regular expression is a pure Perl regexp and has all of the features and functionallty which Perl5 gives you. Note that the syslog date is matched by swatch++ so most all regexps will need .* as the first two characters to match any junk between the date and the interesting bits of the line.

Threshold interval
    In order to avoid information overload, with swatch++ you have the ability to insist on a certain number of matches for a particular rule within a certain amount of time before the rule will fire. This second field specifies that amount of time, in seconds.

Threshold count
    As described in the previous field, this specifies the number of matches that must occur in the above specified amount of time.

Backoff time
    This specifies the number of seconds the rule will be disabled after a successful execution of its action. So if a computer is going wild and dumping thousands of messages a minute which would cause email, you will not get flooded with email, pages, etc.

Action field
    The action is evaled with certain variables defined. The action has access to any subroutines which were defined in the eval section above. The variables which are defined are:

    $realdate
        The date from the syslog line.

    $matched
        The part of the syslog line which matched the regexp

    $secs
        The number of seconds since the epoch relating to the syslog date line

    $host
        The hostname from the syslog line

    $line
        The complete syslog line

    $todo
        The action to take

    $creg
        The regular expression which fired

Additionally, any variables ($1-$n) which were created by the regular expression are available.

Example:
######################################################################
## rules
##
/.*REPEATED LOGIN FAILURES ON (.*)/:3600:2:7200:&Mail("swatchers","Repeated login failures ($1 this time)");
/.*sendmail: .* SYSERR(.*)/:3600:4:7200:&Mail("swatchers","sendmail system error ($1)");
##
######################################################################

FILES
/etc/swatch++.conf Default Swatch++ configuration file.

SEE ALSO
syslogd(8) swatch++(8) swatch(8) swatch(5)

BUGS
Syntax error messages about problems in the configuration file are less than perfect.