Simple and efficient: use swatch to do Linux log analysis _unix Linux

The log file is an important reference for us to discover system problems. Most system services send messages to the SYSLOGD (System log daemon) when problems arise. The user then discovers and takes action based on the error message. However, for more than 1000 rows of log files, we must use the Log Checking tool to save time and avoid missing important information.

Swatch can literally be understood simply as watcher (Guardian). Other log analysis software periodically scans the log files to report to you about problems or situations that have occurred in the system. The Swatch program not only can do this, but it can scan the log files as aggressively as the syslogd daemon and take corrective action for specific log messages.

I. Preparation

1. Download and decompress the latest Swatch package. It is recommended to obtain a reliable swatch package from Swatch's official website.

Download URL: http://sourceforge.net/projects/swatch/

1 Create the directory where the swatch package is stored.

#mkdir-P/usr/local/src/log

2 Extract the source code package, in the log directory will generate a new directory apache_1.3.33

#tar ZPXF swatch-3.1.1.tar.gz

Two. Installation

#cd swatch-3.1.1
#make
#make Test
#make Install
#make Realclean

After the Swatch program is successfully installed, the Perl module will be used to run the Swatch program.

Three. Configure

The Swatch program uses a forward expression (Regular Expressions) to discover the target row of interest. Once Swatch finds a line that matches a preset pattern, it takes immediate action, such as screen printing, email, or user-pre-set action.

Watchfor/[dd]enied│/den.*ed/
Echo Bold
Bell 3
Mail
Exec "/etc/call_pager 5551234 08"

The above script is an example of a part of the Swatch configuration file. First swatch in the specified log file for the line containing the set word "denied, denied, or other words that start with den or End with Ed." Once you have searched for a row that contains three search words. The Swatch program immediately displays bold lines and three bells to the terminal, and then sends an e-mail message to the user who is running the Swatch program (usually
Root user alerts are in line and execute/etc/call_paper programs, ignoring sendmail, fax, unimportant stuff. In this example, the search string sendmail, fax and unimportant stuff will be ignored. Even they match one of the predetermined search strings.

Four. Use

Using Swatch is very simple, such as the usual use of Swatch check log, run:
Swatch--config-file=/home/zhaoke/swatch.conf
--examine=/var/log/messages

In the above example, the configuration file in the system absolute path is/home/zhaoke/swatch.conf, you need to check the log file is/var/log/messages.

Use Swatch to check for additional log files:
Swatch--config-file=/home/zhaoke/swatch.conf
--tail-file=/var/log/messages

Five. More

About the author: Zhaoke, operating system research and security engineer.
Zhaoke.net is the author's personal website. Welcome to technical Exchange and link exchange.

Original source: http://zhaoke.net/articles/general/2005-02-04.shtml

Copyright notice: Quote or reprint, please specify the author and source. And please keep the connection to this article.

If you have a problem or error, please submit to:
Http://zhaoke.net/os/forum.php?do=viewtopic&cat=2&topic=5