Tenshi 0.13 Release a log monitoring program

Tenshi is a log monitoring scheme designed to match user-defined regular expressions with matching report log files. The time interval and list of message recipients that the regular expression assigns to queue alerts. Once a log is generated you can set up queues to send notifications as soon as assigned to them, or send regular reports. In addition, lines in the log (such as PID numbers) are less important in the field, and can be masked with standard regular expressions using the grouping operator (). This makes the report cleaner and easier to read. All reports separate the hostname and, if possible, all messages are frozen.

Tenshi This version adds a threshold feature that counts below the specified value for discard logs. Fix the problem of broken queue exits. Delay daemonization Boot error issue. And make sure that the color of the terminal can always be reset. Improved cleanup exits.

Example：

You can consider setting up tenshi.conf:

Set Hidepid onset queue mail tenshi@localhost sysadmin@localhost [0 */12 * * *]set Queue Misc Tenshi@localhost sysadmin@localhost [0 */24 * * *]set queue unacknowledged tenshi@localhost sysadmin@localhost [Now]group ^ipop3d:mail ^ipop3d: Login user= (. +) Mail ^ipop3d:logout user= (. +) Mail ^ipop3d:pop3s SSL service init from (. +) Mail ^IPOP3D:POP3 service Init From (. +) mail ^ipop3d:command stream end of file, while Reading.+mail ^ipop3d:command stream end of file while reading.+ Unacknowledged ^ipop3d:login Failed.+trash ^ipop3d:.+group_endcritical ^sudo: (. +): tty= (. +); pwd= (. +); User=root; command= (. +) Misc. *

This is a sample of a message queue (sent every 12 hours) Report:

Host1:79:ipop3d:login user=___ 74:ipop3d:logout user=___host2:30:ipop3d:login user=___ 30:ipop3d:logout user=___ 19: IPOP3D:POP3 service init from ___ 12:ipop3d:pop3s SSL service init from ___ 1:ipop3d:command Stream end of file while reading L Ine user=??? host=bogus.domain.net [192.168.0.1] 1:ipop3d:command stream end of file, while reading authentication host= bogus1.domain.net [10.1.7.1]

This is the key queue (send a message to each matching regexp) Sample report:

Host1:1:/usr/bin/sudo: ___: tty=___; pwd=___; User=root; Command=/bin/dmesghost1:1:/usr/bin/sudo: ___: tty=___; pwd=___; User=root; Command=/bin/bashhost2:1: Ipop3d:login failed user=admin auth=admin host=bogus1.domain.net [10.1.7.1]host2:1: Ipop3d: Autologout user=??? host=bogus.domain.net [192.168.0.1]

Download Address: http://dev.inversepath.com/tenshi/tenshi-latest.tar.gz