aboutsummaryrefslogtreecommitdiffstats
path: root/main/swatch
diff options
context:
space:
mode:
Diffstat (limited to 'main/swatch')
-rw-r--r--main/swatch/APKBUILD58
-rw-r--r--main/swatch/swatch.confd8
-rwxr-xr-xmain/swatch/swatch.initd50
-rw-r--r--main/swatch/swatchrc103
4 files changed, 219 insertions, 0 deletions
diff --git a/main/swatch/APKBUILD b/main/swatch/APKBUILD
new file mode 100644
index 0000000000..9d06df638e
--- /dev/null
+++ b/main/swatch/APKBUILD
@@ -0,0 +1,58 @@
+# Contributor: Mika Havela <mika.havela@gmail.com>
+# Maintainer: Mika Havela <mika.havela@gmail.com>
+pkgname=swatch
+pkgver=3.2.3
+pkgrel=0
+pkgdesc="Logfile monitoring tool"
+url="http://sourceforge.net/projects/swatch/"
+license="GPL"
+depends="perl perl-date-calc perl-date-format perl-date-manip perl-file-tail perl-carp-clan"
+makedepends="perl-dev"
+install=
+subpackages="$pkgname-doc"
+source="http://downloads.sourceforge.net/$pkgname/$pkgname-$pkgver.tar.gz
+ swatch.initd
+ swatch.confd
+ swatchrc"
+
+_builddir="$srcdir"/$pkgname-$pkgver
+
+prepare() {
+ cd "$_builddir"
+}
+
+build() {
+ cd "$_builddir"
+ PERL_MM_USE_DEFAULT=1 perl Makefile.PL INSTALLDIRS=vendor || return 1
+ make || return 1
+ make test || return 1
+}
+
+package() {
+ cd "$_builddir"
+ make DESTDIR="$pkgdir" install
+ make realclean || return 1
+
+ # remove perllocal.pod and .packlist
+ find "$pkgdir" -name perllocal.pod -delete
+ find "$pkgdir" -name .packlist -delete
+
+
+#echo "pkdir= $pkgdir"
+#echo "srcdir= $srcdir"
+
+ mkdir -p "$pkgdir"/etc/init.d/
+ mkdir -p "$pkgdir"/etc/conf.d/
+ mkdir -p "$pkgdir"/etc/$pkgname/
+
+ cp "$srcdir"/$pkgname.initd "$pkgdir"/etc/init.d/$pkgname
+ cp "$srcdir"/$pkgname.confd "$pkgdir"/etc/conf.d/$pkgname
+ cp "$srcdir"/${pkgname}rc "$pkgdir"/etc/$pkgname/${pkgname}rc
+
+ chmod 755 "$pkgdir"/etc/init.d/$pkgname
+}
+
+md5sums="1162f1024cf07fc750ed4960d61ac4e8 swatch-3.2.3.tar.gz
+cc99f0831b4a069f90fdedee82495523 swatch.initd
+a02a10a0266781a1ce16cc3b5e84968c swatch.confd
+8a92d37f96982030e0283dc7fe706da8 swatchrc"
diff --git a/main/swatch/swatch.confd b/main/swatch/swatch.confd
new file mode 100644
index 0000000000..5cbdc0a205
--- /dev/null
+++ b/main/swatch/swatch.confd
@@ -0,0 +1,8 @@
+## tail-args
+# Arguments for tail program
+tailargs="-n 0 -F"
+
+## script-dir
+# This switch causes the temporary watcher script to be written to a file in the specified directory rather than the user's home directory.
+# It is highly advised that you do NOT use directories that are writable by others such as /tmp.
+scriptdir="/tmp/swatch"
diff --git a/main/swatch/swatch.initd b/main/swatch/swatch.initd
new file mode 100755
index 0000000000..ec625e4026
--- /dev/null
+++ b/main/swatch/swatch.initd
@@ -0,0 +1,50 @@
+#!/sbin/runscript
+
+# swatch init.d file for alpine linux.
+
+name=swatch
+daemon=/usr/bin/$name
+configfile=/etc/${name}/swatchrc
+tailfile=/var/log/messages
+
+SVC="${SVCNAME#*.}"
+if [ -n "${SVC}" ] && [ "${SVCNAME}" != "${name}" ]; then
+ SVCPID="${name}.${SVC}.pid"
+ configfile="${configfile}.${SVC}"
+ tailfile=$(find /var/log -name "${SVC}" | head -1)
+ [ ! "${tailfile}" ] && tailfile="/var/log/${SVC}"
+else
+ SVCPID="${name}.pid"
+fi
+
+depend() {
+# need net
+ after syslog
+}
+
+start() {
+ ebegin "Starting ${name}"
+ einfo "Preparing to monitor ${tailfile}"
+ if [ ! -e "${tailfile}" ]; then
+ eerror "${tailfile} does not exist"
+ return 1
+ fi
+ if [ ! -e "${configfile}" ]; then
+ eerror "Configfile ${configfile} is missing"
+ return 1
+ fi
+ mkdir -p "${scriptdir}"
+ start-stop-daemon --start --quiet --background \
+ --make-pidfile --pidfile /var/run/${SVCPID} \
+ --exec ${daemon} -- \
+ --config-file="${configfile}" --script-dir="${scriptdir}" \
+ --tail-file="${tailfile}" --tail-args="${tailargs}"
+ eend $?
+}
+
+stop() {
+ ebegin "Stopping ${name}"
+ kill $(ps | grep .swatch_script.$(cat /var/run/${SVCPID}) | grep -v 'grep' | awk '{ print $1}')
+ eend $?
+}
+
diff --git a/main/swatch/swatchrc b/main/swatch/swatchrc
new file mode 100644
index 0000000000..3ea2615a94
--- /dev/null
+++ b/main/swatch/swatchrc
@@ -0,0 +1,103 @@
+###############################################################################
+### Swatch example config
+#
+# The configuration file is used by the swatch(8) program to determine what
+# types of expression patterns to look for and what type of action(s) should be
+# taken when a pattern is matched.
+# Each line should contain a keyword and a, sometimes optional, value for that
+# keyword. The keyword and value are separated by a space or an equal (=) sign.
+#
+# watchfor regex
+# ignore regex
+#
+# echo [modes]
+# Echo the matched line. The text mode may be normal, bold, underscore,
+# blink, inverse, black, red, green, yellow, blue, magenta, cyan, white,
+# black_h, red_h, green_h, yellow_h, blue_h, magenta_h, cyan_h,
+# and/or white_h. The _h colors specify a highlighting color. The other
+# colors are assigned to the letters. Some modes may not work on some
+# terminals. Normal is the default.
+# bell [N]
+# Echo the matched line, and send a bell N times (default = 1).
+# exec command
+# Execute command. The command may contain variables which are substituted
+# with fields from the matched line. A $N will be replaced by the Nth field
+# in the line. A $0 or $* will be replaced by the entire line.
+# mail [addresses=address:address:...][,subject=your_text_here]
+# Send mail to address(es) containing the matched lines as they appear
+# (default address is the user who is running the program).
+# pipe command[,keep_open]
+# Pipe matched lines into command. Use the keep_open option to force the
+# pipe to stay open until a different pipe action is run or until swatch
+# exits.
+# write [user:user:...]
+# Use write(1) to send matched lines to user(s).
+# threshold track_by=key, type=<limit|threshold|both, count=number, seconds=number>
+# Thresholding can be done for the complete watchfor block and/or for
+# individual actions. Add ``threshold=on'' as an option along with the other
+# threshold options when thresholding an individual action.
+# track_by
+# The value of this should be something that is unique to the
+# watchfor regular expression. Tip: enclose unique parts of the
+# regular expression in parentheses, then use the sub matches as
+# part of the value (e.g. track_by=``$2:$4'').
+# type
+# There are three types of thresholding. They are as follows:
+# limit
+# Perform action(s) for the first "count`` matches during
+# the time interval specified by ''seconds", then ignore
+# events for the rest of the time interval (kind of like
+# throttle)
+# threshold
+# Perform action(s) on each match for up to count matches
+# during the time interval specified by seconds
+# both
+# Perform actions(s) once per time interval after "count``
+# matches occur, then ignore additional matches during the
+# time interval specified by ''seconds"
+# continue
+# Use this action to cause swatch to continue to try to match other
+# pattern/action groups after it is done with the current pattern/action
+# block.
+# quit
+# Use this action to cause swatch to clean up and quit immediately.
+###############################################################################
+
+## Successful SSH Login Attempts
+watchfor /sshd.*(: [aA]ccepted)(.*)( from )(.*)( port .*)$/
+ threshold track_by=$4,type=limit,count=1,seconds=60
+ echo bold green
+ #mail='receiver@foo.bar',SUBJECT=sshd: Accepted connection,MAILER=sendmail -t -S smtp.foo.bar -f sender\@foo.bar
+
+## Invalid SSH Login Attempts
+watchfor /sshd.*(: [iI]nvalid [uU]ser )(.*)( from )(.*)$/
+ threshold track_by=$4,type=both,count=3,seconds=60
+ echo bold red
+
+## Failed SSH Login Attempts
+watchfor /sshd.*(: [fF]ailed password for )(.*)( from )(.*)( port )(.*)$/
+ threshold track_by=$4,type=both,count=3,seconds=60
+ echo bold red
+
+## Failed SSH Login Attempts
+watchfor /([aA]uthentication [fF]ailure for [iI]llegal [uU]ser )(.*)( from )(.*)$/
+ threshold track_by=$4,type=both,count)3,seconds=60
+ echo bold red
+
+
+## Invalid sudo commands
+watchfor /sudo:.*[Cc]ommand not allowed/
+ echo bold red
+
+## File system full
+watchfor /file system full/
+ echo bold blue
+
+## System crashes and halts
+watchfor /(panic|halt)/
+ echo bold red
+
+## File system errors
+watchfor /[Mm]edia [Ee]rror/
+ echo bold yellow
+