1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
|
Sample SEC startup files (contributed by Mark Bergman)
--------------------- /etc/init.d/sec --------------------------------
#!/bin/bash
#
# chkconfig: 2345 26 74
# description: Simple Event Correlator script to filter log file entries
# config: /etc/sysconfig/sec
#
CONFIG=/etc/sysconfig/sec
SEC=/usr/local/bin/sec.pl
# Source function library.
. /etc/init.d/functions
RETVAL=0
start() {
echo -n "Starting up Syslog Event Correlator: "
while read command
do
command=`echo $command | sed -e "s/\#.*//" -e "s/^ *//" -e 's/ *$//' -e '/^$/d'`
if [ ! -z "$command" ] ; then
daemon $SEC $command
RETVAL=$(( $? + RETVAL ))
fi
done < $CONFIG
if [ $RETVAL -eq 0 ] && touch /var/lock/subsys/sensors ; then
echo_success
echo
else
echo_failure
echo
fi
}
stop() {
echo -n $"Shutting down sec.pl: "
killproc sec.pl
RETVAL=$?
if [ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/sensors ; then
echo_success
echo
else
echo_failure
echo
fi
}
dostatus() {
$PSENSORS
RETVAL=$?
}
restart() {
stop
start
RETVAL=$?
}
condrestart() {
[ -e /var/lock/subsys/sensors ] && restart || :
}
# See how we were called.
case "$1" in
start)
start
;;
stop)
stop
;;
status)
dostatus
;;
restart|reload)
restart
;;
condrestart)
condrestart
;;
*)
echo "Usage: sec {start|stop|status|restart|reload|condrestart}"
exit 1
esac
exit $RETVAL
----------------------------------------------------------------------
--------------------- /etc/sysconfig/sec -----------------------------
# config file for the Simple Event Correlator
# See: http://kodu.neti.ee/~risto/sec/
#
# This config file has complete command lines--except for the sec.pl executable
#
# Config to monitor local1
-detach -conf=/usr/local/etc/sec/local1.sec -input=/var/log/local1 -log=/var/log/sec.log
----------------------------------------------------------------------
|