testing/swatch: new aport

4 files changed, 219 insertions, 0 deletions

diff --git a/testing/swatch/APKBUILD b/testing/swatch/APKBUILD
new file mode 100644
index 0000000000..9d06df638e
--- /dev/null
+++ b/testing/swatch/APKBUILD
@@ -0,0 +1,58 @@
+# Contributor: Mika Havela <mika.havela@gmail.com>
+# Maintainer: Mika Havela <mika.havela@gmail.com>
+pkgname=swatch
+pkgver=3.2.3
+pkgrel=0
+pkgdesc="Logfile monitoring tool"
+url="http://sourceforge.net/projects/swatch/"
+license="GPL"
+depends="perl perl-date-calc perl-date-format perl-date-manip perl-file-tail perl-carp-clan"
+makedepends="perl-dev"
+install=
+subpackages="$pkgname-doc"
+source="http://downloads.sourceforge.net/$pkgname/$pkgname-$pkgver.tar.gz
+	swatch.initd
+	swatch.confd
+	swatchrc"
+
+_builddir="$srcdir"/$pkgname-$pkgver
+
+prepare() {
+	cd "$_builddir"
+}
+
+build() {
+	cd "$_builddir"
+	PERL_MM_USE_DEFAULT=1 perl Makefile.PL INSTALLDIRS=vendor || return 1
+        make || return 1
+        make test || return 1
+}
+
+package() {
+	cd "$_builddir"
+	make DESTDIR="$pkgdir" install
+        make realclean || return 1
+
+	# remove perllocal.pod and .packlist
+	find "$pkgdir" -name perllocal.pod -delete
+	find "$pkgdir" -name .packlist -delete
+
+
+#echo "pkdir= $pkgdir"
+#echo "srcdir= $srcdir"
+
+	mkdir -p "$pkgdir"/etc/init.d/
+	mkdir -p "$pkgdir"/etc/conf.d/
+	mkdir -p "$pkgdir"/etc/$pkgname/
+
+	cp "$srcdir"/$pkgname.initd "$pkgdir"/etc/init.d/$pkgname
+	cp "$srcdir"/$pkgname.confd "$pkgdir"/etc/conf.d/$pkgname
+	cp "$srcdir"/${pkgname}rc "$pkgdir"/etc/$pkgname/${pkgname}rc
+
+	chmod 755 "$pkgdir"/etc/init.d/$pkgname
+}
+
+md5sums="1162f1024cf07fc750ed4960d61ac4e8  swatch-3.2.3.tar.gz
+cc99f0831b4a069f90fdedee82495523  swatch.initd
+a02a10a0266781a1ce16cc3b5e84968c  swatch.confd
+8a92d37f96982030e0283dc7fe706da8  swatchrc"
diff --git a/testing/swatch/swatch.confd b/testing/swatch/swatch.confd
new file mode 100644
index 0000000000..5cbdc0a205
--- /dev/null
+++ b/testing/swatch/swatch.confd
@@ -0,0 +1,8 @@
+## tail-args
+#   Arguments for tail program
+tailargs="-n 0 -F"
+
+## script-dir
+#   This switch causes the temporary watcher script to be written to a file in the specified directory rather than the user's home directory.
+#   It is highly advised that you do NOT use directories that are writable by others such as /tmp.
+scriptdir="/tmp/swatch"
diff --git a/testing/swatch/swatch.initd b/testing/swatch/swatch.initd
new file mode 100755
index 0000000000..ec625e4026
--- /dev/null
+++ b/testing/swatch/swatch.initd
@@ -0,0 +1,50 @@
+#!/sbin/runscript
+
+# swatch init.d file for alpine linux.
+
+name=swatch
+daemon=/usr/bin/$name
+configfile=/etc/${name}/swatchrc
+tailfile=/var/log/messages
+
+SVC="${SVCNAME#*.}"
+if [ -n "${SVC}" ] && [ "${SVCNAME}" != "${name}" ]; then
+	SVCPID="${name}.${SVC}.pid"
+	configfile="${configfile}.${SVC}"
+	tailfile=$(find /var/log -name "${SVC}" | head -1)
+	[ ! "${tailfile}" ] && tailfile="/var/log/${SVC}"
+else
+	SVCPID="${name}.pid"
+fi
+
+depend() {
+#	need net
+	after syslog
+}
+
+start() {
+	ebegin "Starting ${name}"
+		einfo "Preparing to monitor ${tailfile}"
+		if [ ! -e "${tailfile}" ]; then
+			eerror "${tailfile} does not exist"
+			return 1
+		fi
+		if [ ! -e "${configfile}" ]; then
+			eerror "Configfile ${configfile} is missing"
+			return 1
+		fi
+		mkdir -p "${scriptdir}"
+		start-stop-daemon --start --quiet --background \
+			--make-pidfile --pidfile /var/run/${SVCPID} \
+			--exec ${daemon} -- \
+			--config-file="${configfile}" --script-dir="${scriptdir}" \
+			--tail-file="${tailfile}" --tail-args="${tailargs}"
+	eend $?
+}
+
+stop() {
+	ebegin "Stopping ${name}"
+		kill $(ps | grep .swatch_script.$(cat /var/run/${SVCPID}) | grep -v 'grep' | awk '{ print $1}')
+	eend $?
+}
+
diff --git a/testing/swatch/swatchrc b/testing/swatch/swatchrc
new file mode 100644
index 0000000000..3ea2615a94
--- /dev/null
+++ b/testing/swatch/swatchrc
@@ -0,0 +1,103 @@
+###############################################################################
+### Swatch example config
+#
+# The configuration file is used by the swatch(8) program to determine what
+# types of expression patterns to look for and what type of action(s) should be
+# taken when a pattern is matched.
+# Each line should contain a keyword and a, sometimes optional, value for that
+# keyword. The keyword and value are separated by a space or an equal (=) sign.
+#
+# watchfor regex
+# ignore regex
+#
+# echo [modes]
+#    Echo the matched line. The text mode may be normal, bold, underscore,
+#    blink, inverse, black, red, green, yellow, blue, magenta, cyan, white,
+#    black_h, red_h, green_h, yellow_h, blue_h, magenta_h, cyan_h,
+#    and/or white_h. The _h colors specify a highlighting color. The other
+#    colors are assigned to the letters. Some modes may not work on some
+#    terminals. Normal is the default.
+# bell [N]
+#    Echo the matched line, and send a bell N times (default = 1).
+# exec command
+#    Execute command. The command may contain variables which are substituted
+#    with fields from the matched line. A $N will be replaced by the Nth field
+#    in the line. A $0 or $* will be replaced by the entire line.
+# mail [addresses=address:address:...][,subject=your_text_here]
+#    Send mail to address(es) containing the matched lines as they appear
+#    (default address is the user who is running the program).
+# pipe command[,keep_open]
+#    Pipe matched lines into command. Use the keep_open option to force the
+#    pipe to stay open until a different pipe action is run or until swatch
+#    exits.
+# write [user:user:...]
+#    Use write(1) to send matched lines to user(s).
+# threshold track_by=key, type=<limit|threshold|both, count=number, seconds=number>
+#    Thresholding can be done for the complete watchfor block and/or for
+#    individual actions. Add ``threshold=on'' as an option along with the other
+#    threshold options when thresholding an individual action.
+#        track_by
+#            The value of this should be something that is unique to the
+#            watchfor regular expression. Tip: enclose unique parts of the
+#            regular expression in parentheses, then use the sub matches as
+#            part of the value (e.g. track_by=``$2:$4'').
+#        type
+#            There are three types of thresholding. They are as follows:
+#                limit
+#                    Perform action(s) for the first "count`` matches during
+#                    the time interval specified by ''seconds", then ignore
+#                    events for the rest of the time interval (kind of like
+#                    throttle)
+#                threshold
+#                    Perform action(s) on each match for up to count matches 
+#                    during the time interval specified by seconds
+#                both
+#                    Perform actions(s) once per time interval after "count``
+#                    matches occur, then ignore additional matches during the
+#                    time interval specified by ''seconds"
+# continue
+#    Use this action to cause swatch to continue to try to match other
+#    pattern/action groups after it is done with the current pattern/action
+#    block.
+# quit
+#    Use this action to cause swatch to clean up and quit immediately. 
+###############################################################################
+
+## Successful SSH Login Attempts
+watchfor        /sshd.*(: [aA]ccepted)(.*)( from )(.*)( port .*)$/
+		threshold track_by=$4,type=limit,count=1,seconds=60
+		echo bold green
+		#mail='receiver@foo.bar',SUBJECT=sshd: Accepted connection,MAILER=sendmail -t -S smtp.foo.bar -f sender\@foo.bar
+
+## Invalid SSH Login Attempts
+watchfor	/sshd.*(: [iI]nvalid [uU]ser )(.*)( from )(.*)$/
+		threshold track_by=$4,type=both,count=3,seconds=60
+		echo bold red
+
+## Failed SSH Login Attempts
+watchfor	/sshd.*(: [fF]ailed password for )(.*)( from )(.*)( port )(.*)$/
+		threshold track_by=$4,type=both,count=3,seconds=60
+		echo bold red
+
+## Failed SSH Login Attempts
+watchfor	/([aA]uthentication [fF]ailure for [iI]llegal [uU]ser )(.*)( from )(.*)$/
+        	threshold track_by=$4,type=both,count)3,seconds=60
+		echo bold red
+
+
+## Invalid sudo commands 
+watchfor        /sudo:.*[Cc]ommand not allowed/
+                echo bold red
+
+## File system full
+watchfor	/file system full/
+		echo bold blue
+
+## System crashes and halts
+watchfor	/(panic|halt)/
+		echo bold red
+
+## File system errors
+watchfor	/[Mm]edia [Ee]rror/
+		echo bold yellow
+