1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
|
tenshi 0.13 README
Copyright 2004-2011 Andrea Barisani <andrea@inversepath.com>
- What's tenshi?
tenshi is a log monitoring program, designed to watch one or more log files for
lines matching user defined regular expressions and report on the matches. The
regular expressions are assigned to queues which have an alert interval and a
list of mail recipients.
Please read the example tenshi.conf and tenshi.8 man page for usage
instructions.
tenshi was formerly known as wasabi. The name was changed to tenshi after we
were informed that wasabi is a registered trademark relating to another piece
of software.
It should be noted that tenshi was initially a perl rewrite of Oak
(http://www.ktools.org).
- Examples:
Consider the following settings in tenshi.conf:
set hidepid on
set queue mail tenshi@localhost sysadmin@localhost [0 */12 * * *]
set queue misc tenshi@localhost sysadmin@localhost [0 */24 * * *]
set queue critical tenshi@localhost sysadmin@localhost [now]
group ^ipop3d:
mail ^ipop3d: Login user=(.+)
mail ^ipop3d: Logout user=(.+)
mail ^ipop3d: pop3s SSL service init from (.+)
mail ^ipop3d: pop3 service init from (.+)
mail ^ipop3d: Command stream end of file, while reading.+
mail ^ipop3d: Command stream end of file while reading.+
critical ^ipop3d: Login failed.+
trash ^ipop3d:.+
group_end
critical ^sudo: (.+) : TTY=(.+) ; PWD=(.+) ; USER=root ; COMMAND=(.+)
misc .*
Every ipop3d message not matched by the regexps assigned to the queue mail or
critical will be matched by the queue trash (a builtin null queue), any other
message will be matched by queue misc. Fields enclosed in (.+) are masked.
This is a sample report for the mail queue (sent every 12 hours):
host1:
79: ipop3d: Login user=___
74: ipop3d: Logout user=___
host2:
30: ipop3d: Login user=___
30: ipop3d: Logout user=___
19: ipop3d: pop3 service init from ___
12: ipop3d: pop3s SSL service init from ___
1: ipop3d: Command stream end of file while reading line user=??? host=bogus.domain.net [192.168.0.1]
1: ipop3d: Command stream end of file, while reading authentication host=bogus1.domain.net [10.1.7.1]
These are sample reports for the critical queue (sent every time a message matches the regexp):
host1:
1: /usr/bin/sudo: ___ : TTY=___ ; PWD=___ ; USER=root ; COMMAND=/bin/dmesg
host1:
1: /usr/bin/sudo: ___ : TTY=___ ; PWD=___ ; USER=root ; COMMAND=/bin/bash
host2:
1: ipop3d: Login failed user=admin auth=admin host=bogus1.domain.net [10.1.7.1]
host2:
1: ipop3d: Autologout user=??? host=bogus.domain.net [192.168.0.1]
- Requirements:
This is a perl program that uses 'tail' (when not using a FIFO) which should be
included in your OS.
It also requires Net::SMTP module for mailing reports, which should be included
in your perl installation, and IO::BufferedSelect. If you miss any of them you
can grab them at CPAN (http://www.cpan.org) or using the CPAN shell (perl -e
shell -MCPAN).
- Resources:
The tenshi project page is http://www.inversepath.com/tenshi.html
Please report any bugs you find at <tenshi@inversepath.com>.
|
