SWATCH設定／運用

• #!/bin/sh
  
  # swatch stop
  /usr/bin/killall tail
  /bin/sleep 3
  
  #  log rotate
  /usr/sbin/logrotate /etc/logrotate.conf
  
  touch /var/log/messages
  touch /var/log/secure
  
  # swatch start
  /etc/init.d/swatch start

# swatchrc_secure
watchfor = /refused/
	echo
	mail=aqure

#
watchfor = /refused/
	echo
	mail=aqure
#
watchfor = /authentication failure/
	echo
	mail aqure

# swatch スクリプト
#!/bin/sh
#
# swatch   swatch is monitaring for logs and specific action from external
#          will send mail for specific users.
#
# chkconfig: 2345 42 42
# description: monitaring logs tool.
# processname: swatch
# config: /etc/swatch/swatch_secure

# Source function library.
. /etc/rc.d/init.d/functions

# Source networking configuration.
. /etc/sysconfig/network

# Check that networking is up.
[ ${NETWORKING} = "no" ] && exit 0

[ -f /usr/bin/swatch ] || exit 0
[ -f /etc/swatch/swatch_secure ] || exit 0

RETVAL=0

# See how we were called.
case "$1" in
  start)
        # Start daemons.
        echo -n "Starting swatch_secure: "
        swatch -c /etc/swatch/swatch_secure -t /var/log/secure &
        swatch -c /etc/swatch/swatch_messages -t /var/log/messages &
	RETVAL=$?
        echo
        [ $RETVAL -eq 0 ] && touch /var/lock/subsys/swatch
        ;;
  stop)
        # Stop daemons.
        echo -n "Shutting down swatch: "
	#killproc swatch
        #pid=`pidof tail`

	pid_secure=`ps ax | grep secure | awk '{print $1}'`
	pid_message=`ps ax | grep message | awk '{print $1}'`

        #kill -9 $pid > /dev/null 2>&1
        kill -9 $pid_secure > /dev/null 2>&1
        kill -9 $pid_message > /dev/null 2>&1

	RETVAL=$?
        echo
        [ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/swatch
        ;;
  status)
	status swatch
	RETVAL=$?
	;;
  restart|reload)
	$0 stop
	$0 start
	RETVAL=$?
	;;
  *)
        echo "Usage: swatch {start|stop|restart|reload|status}"
        exit 1
esac

exit $RETVAL