diff --git a/sec.init b/sec.init deleted file mode 100755 index 0c15c30..0000000 --- a/sec.init +++ /dev/null @@ -1,102 +0,0 @@ -#!/bin/bash -# -# sec Start and stop SEC. -# -# chkconfig: - 20 80 -# description: Simple Event Correlator script to filter log file entries - -. /etc/rc.d/init.d/functions - -prog="sec" -exec="/usr/bin/sec" -lockfile="/var/lock/subsys/sec" - -[ -e /etc/sysconfig/$prog ] && . /etc/sysconfig/$prog - -start() { - [ -x $exec ] || exit 5 - for n in `seq 0 $((${#SEC_ARGS[*]} - 1))`; do - echo -n $"Starting $prog instance "$(($n + 1))": " - daemon $exec ${SEC_ARGS[$n]} - RETVAL=$? - echo - [ $RETVAL -ne 0 ] && return $RETVAL - done - touch $lockfile - return $RETVAL -} - -stop() { - echo -n $"Stopping $prog: " - killproc $prog - RETVAL=$? - echo - [ $RETVAL -eq 0 ] && rm -f $lockfile - return $RETVAL -} - -restart() { - stop - start -} - -reload() { - echo -n $"Reloading $prog: " - killproc $prog -HUP - RETVAL=$? - echo - return $RETVAL -} - -force_reload() { - restart -} - -rh_status() { - status $prog -} - -rh_status_q() { - rh_status >/dev/null 2>&1 -} - -dump() { - echo -n $"Dumping state of $prog in /tmp/sec.dump: " - killproc $prog -USR1 - RETVAL=$? - echo - return $RETVAL -} - -case "$1" in - start) - start - ;; - stop) - stop - ;; - restart) - restart - ;; - condrestart|try-restart) - rh_status_q || exit 0 - restart - ;; - reload) - reload - ;; - force-reload) - force_reload - ;; - status) - rh_status - ;; - dump) - dump - ;; - *) - echo $"Usage: $0 {start|stop|restart|condrestart|try-restart|reload|force-reload|status|dump}" - exit 2 -esac - -exit $? diff --git a/sec.logrotate b/sec.logrotate index 87b02c3..917a7bc 100644 --- a/sec.logrotate +++ b/sec.logrotate @@ -3,6 +3,6 @@ notifempty sharedscripts postrotate - /sbin/service sec reload >/dev/null 2>&1 || true + [ ! -f /run/sec.pid ] || kill -USR2 `cat /run/sec.pid` endscript } diff --git a/sec.spec b/sec.spec index b0ec8e6..f04b673 100644 --- a/sec.spec +++ b/sec.spec @@ -1,12 +1,13 @@ Name: sec Version: 2.7.7 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons License: GPLv2+ URL: http://simple-evcorr.sourceforge.net/ Source0: http://downloads.sourceforge.net/simple-evcorr/%{name}-%{version}.tar.gz Source1: sec.service +Source2: sec@.service Source3: sec.logrotate # Example files and configuration info Source4: conf.README @@ -31,6 +32,8 @@ Source22: http://simple-evcorr.sourceforge.net/rulesets/ssh-brute.sec Source23: http://simple-evcorr.sourceforge.net/rulesets/ssh.sec Source24: http://simple-evcorr.sourceforge.net/rulesets/vtund.sec Source25: http://simple-evcorr.sourceforge.net/rulesets/windows.sec +# +Source26: sec.sysconfig BuildArch: noarch BuildRequires: systemd @@ -70,6 +73,8 @@ install -m 0644 -p %{SOURCE5} %{SOURCE6} %{SOURCE7} %{SOURCE8} \ %{SOURCE17} %{SOURCE18} %{SOURCE19} %{SOURCE20} \ %{SOURCE21} %{SOURCE22} %{SOURCE23} %{SOURCE24} \ %{SOURCE25} examples/ +install -m 0644 -p %{SOURCE2} sec@.service +install -m 0644 -p %{SOURCE26} sec.sysconfig # Remove executable bits because these files get packed as docs chmod 0644 contrib/convert.pl contrib/swatch2sec.pl @@ -88,7 +93,7 @@ rm -rf %{buildroot} %files %defattr(-,root,root,-) -%doc ChangeLog COPYING README contrib/convert.pl contrib/itostream.c contrib/swatch2sec.pl examples +%doc ChangeLog COPYING README contrib/convert.pl contrib/itostream.c contrib/swatch2sec.pl examples sec@.service sec.sysconfig %config(noreplace) %{_sysconfdir}/%{name} %config(noreplace) %{_sysconfdir}/logrotate.d/sec %{_bindir}/sec @@ -96,6 +101,9 @@ rm -rf %{buildroot} %{_unitdir}/sec.service %changelog +* Wed Oct 14 2015 Fedora Release Engineering - 2.7.7-2 +- While rotating logfiles do not do a full restart of the sec instance + * Fri Jun 19 2015 Fedora Release Engineering - 2.7.7-1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild diff --git a/sec.sysconfig b/sec.sysconfig index db96875..1db90e2 100644 --- a/sec.sysconfig +++ b/sec.sysconfig @@ -1,25 +1,17 @@ +# This is an example config file if multiple instances of SEC should be started. +# This file should be located in +# /etc/sysconfig/sec +# and used together with the systemd service file +# sec@.service +# which allows to run multiple sec instances. # -# Because SEC usage varies so widely from user to user, it is configured by -# default to not run. Please read `sec --help` for valid options to use in -# this configuration directive, or use the sample defaults included below. -# -# If you would like to run multiple instances of sec in order to track more -# than one log file, you can use also use $SEC_OPTIONS as an array. -# -# Also, please don't forget to read the sec man page or look at the -# configuration options for /etc/sec/. # +# Below you find an example configuration of two instances named FOO and BAR. +# The instances can be started via the commands +# systemctl start sec@FOO and systemctl start sec@BAR +# For further configuration options, consult the systemd file: +# /lib/systemd/system/sec@.service -# -# Default: -# -# SEC_ARGS="-detach -conf=/etc/sec/*.sec -input=/var/log/messages -log=/var/log/sec -intevents -pid=/var/run/sec.pid" -# +OPTIONS_FOO="-input=/var/log/messages" -# -# For Multiple instances of SEC, use something like: -# -# SEC_ARGS[0]="-detach -conf=/etc/sec/sys/*.sec -input=/var/log/messages -log=/var/log/sec -intevents -pid=/var/run/sec.sys.pid" -# -# SEC_ARGS[1]="-detach -conf=/etc/sec/mail/*.sec -input=/var/log/messages -log=/var/log/sec -intevents -pid=/var/run/sec.mail.pid" -# +OPTIONS_BAR="-input=/var/log/syslog" diff --git a/sec@.service b/sec@.service new file mode 100644 index 0000000..f89b139 --- /dev/null +++ b/sec@.service @@ -0,0 +1,12 @@ +[Unit] +Description=Simple Event Correlator (instance %I) +After=syslog.target + +[Service] +Type=forking +PIDFile=/run/sec-%I.pid +ExecStart=/usr/bin/sec -detach -pid=/run/sec-%I.pid -conf=/etc/sec/%I/*.sec -input=/var/log/messages -log=/var/log/sec-%I -intevents $OPTIONS_%I +EnvironmentFile=/etc/sysconfig/sec + +[Install] +WantedBy=multi-user.target