From 297b87d741fe51a43c1346b29ba0fca2739c47b8 Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Thu, 20 Oct 2022 20:23:14 +0200 Subject: [PATCH 1/4] Initial EPEL 9 build --- Makefile | 21 --------------- conf.README | 12 +++++++++ sec.logrotate | 8 ++++++ sec.service | 12 +++++++++ sec.spec | 71 +++++++++++++++++++++++++++++++++++++++++++++++++++ sec.sysconfig | 19 ++++++++++++++ sec@.service | 12 +++++++++ sources | 1 + 8 files changed, 135 insertions(+), 21 deletions(-) delete mode 100644 Makefile create mode 100644 conf.README create mode 100644 sec.logrotate create mode 100644 sec.service create mode 100644 sec.spec create mode 100644 sec.sysconfig create mode 100644 sec@.service diff --git a/Makefile b/Makefile deleted file mode 100644 index a45a953..0000000 --- a/Makefile +++ /dev/null @@ -1,21 +0,0 @@ -# Makefile for source rpm: sec -# $Id$ -NAME := sec -SPECFILE = $(firstword $(wildcard *.spec)) - -define find-makefile-common -for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done -endef - -MAKEFILE_COMMON := $(shell $(find-makefile-common)) - -ifeq ($(MAKEFILE_COMMON),) -# attept a checkout -define checkout-makefile-common -test -f CVS/Root && { cvs -Q -d $$(cat CVS/Root) checkout common && echo "common/Makefile.common" ; } || { echo "ERROR: I can't figure out how to checkout the 'common' module." ; exit -1 ; } >&2 -endef - -MAKEFILE_COMMON := $(shell $(checkout-makefile-common)) -endif - -include $(MAKEFILE_COMMON) diff --git a/conf.README b/conf.README new file mode 100644 index 0000000..252ae6f --- /dev/null +++ b/conf.README @@ -0,0 +1,12 @@ +This is the SEC configuration directory. Because SEC usage varies so widely +from user to user, this package is configured by default to not run. + +The commented-out default settings in /etc/sysconfig/sec will load any file in +this directory with a .sec suffix. You can find several example rules at + + https://github.com/simple-evcorr/rulesets + +and install the ones you want here (taking into account that the examples are +generic and some of them may need to be tweaked to work with your setup). You +should also read the SEC man page so you have at least a basic understanding of +the SEC configuration commands. diff --git a/sec.logrotate b/sec.logrotate new file mode 100644 index 0000000..917a7bc --- /dev/null +++ b/sec.logrotate @@ -0,0 +1,8 @@ +/var/log/sec { + missingok + notifempty + sharedscripts + postrotate + [ ! -f /run/sec.pid ] || kill -USR2 `cat /run/sec.pid` + endscript +} diff --git a/sec.service b/sec.service new file mode 100644 index 0000000..7b05795 --- /dev/null +++ b/sec.service @@ -0,0 +1,12 @@ +[Unit] +Description=Simple Event Correlator script to filter log file entries +After=syslog.target + +[Service] +Type=forking +PIDFile=/run/sec.pid +ExecStart=/usr/bin/sec --detach --pid=/run/sec.pid $OPTIONS +EnvironmentFile=/etc/sysconfig/sec + +[Install] +WantedBy=multi-user.target diff --git a/sec.spec b/sec.spec new file mode 100644 index 0000000..fa1a372 --- /dev/null +++ b/sec.spec @@ -0,0 +1,71 @@ +Name: sec +Version: 2.9.1 +Release: 1%{?dist} +Summary: Simple Event Correlator script to filter log file entries +License: GPLv2+ +URL: https://simple-evcorr.github.io/ +Source0: https://github.com/simple-evcorr/sec/releases/download/%{version}/sec-%{version}.tar.gz +Source1: sec.service +Source2: sec@.service +Source3: sec.logrotate +Source4: sec.sysconfig +Source5: conf.README +BuildArch: noarch + +BuildRequires: perl-generators +BuildRequires: systemd + +Requires: logrotate + +Requires(post): systemd +Requires(preun): systemd +Requires(postun): systemd + +%description +SEC is a simple event correlation tool that reads lines from files, named +pipes, or standard input, and matches the lines with regular expressions, +Perl subroutines, and other patterns for recognizing input events. +Events are then correlated according to the rules in configuration files, +producing output events by executing user-specified shell commands, by +writing messages to pipes or files, etc. + +%prep +%setup -q + +%build + +%install +# Install SEC and its associated files +install -D -m 0755 -p sec %{buildroot}%{_bindir}/sec +install -D -m 0644 -p sec.man %{buildroot}%{_mandir}/man1/sec.1 +install -D -m 0644 -p %{SOURCE1} %{buildroot}%{_unitdir}/sec.service +install -D -m 0644 -p %{SOURCE2} %{buildroot}%{_unitdir}/sec@.service +install -D -m 0644 -p %{SOURCE3} %{buildroot}%{_sysconfdir}/logrotate.d/sec +install -D -m 0644 -p %{SOURCE4} %{buildroot}%{_sysconfdir}/sysconfig/sec +install -D -m 0644 -p %{SOURCE5} %{buildroot}%{_sysconfdir}/%{name}/README + +# Remove executable bits because these files get packed as docs +chmod 0644 contrib/convert.pl contrib/swatch2sec.pl + +%post +%systemd_post sec.service + +%preun +%systemd_preun sec.service + +%postun +%systemd_postun_with_restart sec.service + +%files +%doc ChangeLog COPYING README contrib/convert.pl contrib/itostream.c contrib/swatch2sec.pl +%config(noreplace) %{_sysconfdir}/%{name} +%config(noreplace) %{_sysconfdir}/logrotate.d/sec +%config(noreplace) %{_sysconfdir}/sysconfig/sec +%{_bindir}/sec +%{_mandir}/man1/sec.1* +%{_unitdir}/sec.service +%{_unitdir}/sec@.service + +%changelog +* Thu Oct 20 2022 Stefan Schulze Frielinghaus - 2.9.1-1 +- Initial EPEL 9 build diff --git a/sec.sysconfig b/sec.sysconfig new file mode 100644 index 0000000..a240503 --- /dev/null +++ b/sec.sysconfig @@ -0,0 +1,19 @@ +# Command line options for SEC + +OPTIONS="--conf=/etc/sec/*.sec --input=/var/log/messages --log=/var/log/sec --intevents" + +# This is an example config if multiple instances of SEC should be started. +# These settings should be used together with the systemd service file +# sec@.service +# which allows to run multiple sec instances. +# +# +# Below you find an example configuration of two instances named FOO and BAR. +# The instances can be started via the commands +# systemctl start sec@FOO and systemctl start sec@BAR +# For further configuration options, consult the systemd file: +# /lib/systemd/system/sec@.service + +#OPTIONS_FOO="--conf=/etc/sec/FOO/*.sec --input=/var/log/secure --log=/var/log/sec-FOO --intevents" + +#OPTIONS_BAR="--conf=/etc/sec/BAR/*.sec --input=/var/log/maillog --log=/var/log/sec-BAR --intevents" diff --git a/sec@.service b/sec@.service new file mode 100644 index 0000000..dbf83af --- /dev/null +++ b/sec@.service @@ -0,0 +1,12 @@ +[Unit] +Description=Simple Event Correlator (instance %I) +After=syslog.target + +[Service] +Type=forking +PIDFile=/run/sec-%I.pid +ExecStart=/usr/bin/sec --detach --pid=/run/sec-%I.pid $OPTIONS_%I +EnvironmentFile=/etc/sysconfig/sec + +[Install] +WantedBy=multi-user.target diff --git a/sources b/sources index e69de29..4ae1cca 100644 --- a/sources +++ b/sources @@ -0,0 +1 @@ +SHA512 (sec-2.9.1.tar.gz) = c6764cf660ad969d260e4993c38809580e448a9d941d1a763c1b70630c5d55a7f215feb6b0fa50cbf23d68fb442e34f0d270d03e1172850d63d64042a689ac90 From e79c718ebb48855b208872aafc4487f4eb54feae Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Tue, 6 Jun 2023 07:10:58 +0200 Subject: [PATCH 2/4] New upstream release --- .gitignore | 1 + sec.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) create mode 100644 .gitignore diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..7272147 --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +/sec-2.9.2.tar.gz diff --git a/sec.spec b/sec.spec index fa1a372..9ae65ca 100644 --- a/sec.spec +++ b/sec.spec @@ -1,5 +1,5 @@ Name: sec -Version: 2.9.1 +Version: 2.9.2 Release: 1%{?dist} Summary: Simple Event Correlator script to filter log file entries License: GPLv2+ @@ -67,5 +67,8 @@ chmod 0644 contrib/convert.pl contrib/swatch2sec.pl %{_unitdir}/sec@.service %changelog +* Mon Jun 05 2023 Stefan Schulze Frielinghaus - 2.9.2-1 +- New upstream release + * Thu Oct 20 2022 Stefan Schulze Frielinghaus - 2.9.1-1 - Initial EPEL 9 build diff --git a/sources b/sources index 4ae1cca..89ce004 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (sec-2.9.1.tar.gz) = c6764cf660ad969d260e4993c38809580e448a9d941d1a763c1b70630c5d55a7f215feb6b0fa50cbf23d68fb442e34f0d270d03e1172850d63d64042a689ac90 +SHA512 (sec-2.9.2.tar.gz) = 441c543f9abcfff46c5cd86c9be8fd5c57fef988519f2c9f431b715717e0500ce1b89365e16c0d3b6e76369cf5ee5f6d5318b32e4374c614ec0083833021f17c From b2eef436dd1aca3619614bc8908498dcd9a29bcd Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Sat, 2 Nov 2024 14:12:46 +0100 Subject: [PATCH 3/4] New upstream release --- .gitignore | 1 + sec.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 7272147..52544cb 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,2 @@ /sec-2.9.2.tar.gz +/sec-2.9.3.tar.gz diff --git a/sec.spec b/sec.spec index 9ae65ca..161dc1e 100644 --- a/sec.spec +++ b/sec.spec @@ -1,5 +1,5 @@ Name: sec -Version: 2.9.2 +Version: 2.9.3 Release: 1%{?dist} Summary: Simple Event Correlator script to filter log file entries License: GPLv2+ @@ -67,6 +67,9 @@ chmod 0644 contrib/convert.pl contrib/swatch2sec.pl %{_unitdir}/sec@.service %changelog +* Sat Nov 02 2024 Stefan Schulze Frielinghaus - 2.9.3-1 +- New upstream release + * Mon Jun 05 2023 Stefan Schulze Frielinghaus - 2.9.2-1 - New upstream release diff --git a/sources b/sources index 89ce004..ae04780 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (sec-2.9.2.tar.gz) = 441c543f9abcfff46c5cd86c9be8fd5c57fef988519f2c9f431b715717e0500ce1b89365e16c0d3b6e76369cf5ee5f6d5318b32e4374c614ec0083833021f17c +SHA512 (sec-2.9.3.tar.gz) = 7facf3f5d80ec5466e1e35cc1ab186bbac092bb011816a72e8be6c60eadffca75c5765a914e8700eacf90d7f8c46088bdb17213a7c670c4ca5b852ce30fbdf26 From eef0bcb41b75e71670b4bdec89c9527cc459ba83 Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Thu, 12 Feb 2026 20:49:05 +0100 Subject: [PATCH 4/4] New upstream release --- .gitignore | 1 + sec.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 52544cb..2db1664 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,3 @@ /sec-2.9.2.tar.gz /sec-2.9.3.tar.gz +/sec-2.9.4.tar.gz diff --git a/sec.spec b/sec.spec index 161dc1e..54db3fc 100644 --- a/sec.spec +++ b/sec.spec @@ -1,5 +1,5 @@ Name: sec -Version: 2.9.3 +Version: 2.9.4 Release: 1%{?dist} Summary: Simple Event Correlator script to filter log file entries License: GPLv2+ @@ -67,6 +67,9 @@ chmod 0644 contrib/convert.pl contrib/swatch2sec.pl %{_unitdir}/sec@.service %changelog +* Thu Feb 12 2026 Stefan Schulze Frielinghaus - 2.9.4-1 +- New upstream release + * Sat Nov 02 2024 Stefan Schulze Frielinghaus - 2.9.3-1 - New upstream release diff --git a/sources b/sources index ae04780..30a16bf 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (sec-2.9.3.tar.gz) = 7facf3f5d80ec5466e1e35cc1ab186bbac092bb011816a72e8be6c60eadffca75c5765a914e8700eacf90d7f8c46088bdb17213a7c670c4ca5b852ce30fbdf26 +SHA512 (sec-2.9.4.tar.gz) = e049ea61e52420faddc2ad3373d9ec65cc6187d59e89537d919eb0342688e494c3d9db334347dbaf9a42260930c99756d46ed3f9f015a38bd95f6959ded047d9