swatch is a configurable log file monitor.
this will create the needed default config file that swatch looks for. you can specify any file to be the config file as a command line argument.
this will run swatch with all the default .swatchrc file and will monitor /var/log/messages
swatch --config-file=.swatchrc --tail-file=/var/log/messages
this is the same as running the defaults but as you can change the path of either to specify what and how you want to monitor. relitive links may or may not work i would not work for me. I edited my .bashrc file and included an alias for swatch so that I didn't have to type all that out every time.
this is the only config file you need it will be populated by regular expressions on the types of files you want to watch for or monitor. note that you can have more than one configuration file you just have to specify witch one you want to use at run time.
# # .swatchrc # to run type swatch on command line # watchfor <regexp> echo
this code example tells swatch to watch for a certain pattern and echo the entry to the console if it happens.
# # simple .swatchrc # "swatch" to run # ignore /--MARK--/ #ignores anything with --MARK-- in it watchfor /sudo/ echo = red #echos out in the color red watchfor /deamon/ echo = blue #echos out in the color blue # end
this is simple config file i was using for testing just substituting different values to watch for. i don't have very many log files on my laptop to monitor for so making it more complex at this time is kinda hard. i have to talk to Matt to see if i can get permissions to view the lab46 logs.
# # sample test code for .swatchrc # # to run "swatch --config-file=.swatchrc --tail-file=/var/log/remote_log # ignore /-- MARK --/ watchfor /authentication failure/ echo = red watchfor /(node|nfs)/ #search for node or nfs echo pipe = cut -d ":" -f 1 watchfor /session opened for user $USER/ # replace $USER with your specified user echo = red mail = $USER@offbyone.lan, subject=logon watchfor /.*/ echo # clean up - everything else # end
be careful swatch is a top down driven. so if your first line says to ignore a whole log and your fifth says to email you your never going to get that email. see “continue” above to avoid this.