diff --git a/.gitignore b/.gitignore index 9c8a2a1..e36137e 100644 --- a/.gitignore +++ b/.gitignore @@ -1,13 +1,8 @@ sec-2.5.3.tar.gz -/sec-2.6.0.tar.gz -/sec-2.6.1.tar.gz -/sec-2.6.2.tar.gz /sec-2.7.1.tar.gz /sec-2.7.2.tar.gz -/sec-2.7.3.tar.gz /sec-2.7.4.tar.gz /sec-2.7.5.tar.gz -/sec-2.7.6.tar.gz /sec-2.7.7.tar.gz /sec-2.7.8.tar.gz /sec-2.7.9.tar.gz @@ -18,8 +13,3 @@ sec-2.5.3.tar.gz /sec-2.8.1.tar.gz /sec-2.8.2.tar.gz /sec-2.8.3.tar.gz -/sec-2.9.0.tar.gz -/sec-2.9.1.tar.gz -/sec-2.9.2.tar.gz -/sec-2.9.3.tar.gz -/sec-2.9.4.tar.gz diff --git a/sec.init b/sec.init new file mode 100755 index 0000000..bf6bfb9 --- /dev/null +++ b/sec.init @@ -0,0 +1,117 @@ +#!/bin/bash +# +# sec Start and stop SEC. +# +# chkconfig: - 20 80 +# description: Simple Event Correlator script to filter log file entries + +. /etc/rc.d/init.d/functions + +prog="sec" +exec="/usr/bin/sec" +lockfile="/var/lock/subsys/sec" + +[ -e /etc/sysconfig/$prog ] && . /etc/sysconfig/$prog + +start() { + [ -x $exec ] || exit 5 + for n in `seq 0 $((${#SEC_ARGS[*]} - 1))`; do + echo -n $"Starting $prog instance "$(($n + 1))": " + daemon $exec ${SEC_ARGS[$n]} + RETVAL=$? + echo + [ $RETVAL -ne 0 ] && return $RETVAL + done + touch $lockfile + return $RETVAL +} + +stop() { + echo -n $"Stopping $prog: " + if [ -z "$SHUTDOWN_TIMELIMIT" ]; then + killproc $prog + else + killproc -d $SHUTDOWN_TIMELIMIT $prog + fi + RETVAL=$? + echo + [ $RETVAL -eq 0 ] && rm -f $lockfile + return $RETVAL +} + +restart() { + stop + start +} + +reload() { + echo -n $"Reloading $prog: " + killproc $prog -HUP + RETVAL=$? + echo + return $RETVAL +} + +rotate() { + echo -n $"Rotating $prog: " + killproc $prog -USR2 + RETVAL=$? + echo + return $RETVAL +} + +force_reload() { + restart +} + +rh_status() { + status $prog +} + +rh_status_q() { + rh_status >/dev/null 2>&1 +} + +dump() { + echo -n $"Dumping state of $prog in /tmp/sec.dump: " + killproc $prog -USR1 + RETVAL=$? + echo + return $RETVAL +} + +case "$1" in + start) + start + ;; + stop) + stop + ;; + restart) + restart + ;; + condrestart|try-restart) + rh_status_q || exit 0 + restart + ;; + reload) + reload + ;; + force-reload) + force_reload + ;; + rotate) + rotate + ;; + status) + rh_status + ;; + dump) + dump + ;; + *) + echo $"Usage: $0 {start|stop|restart|condrestart|try-restart|reload|force-reload|rotate|status|dump}" + exit 2 +esac + +exit $? diff --git a/sec.logrotate b/sec.logrotate index 6ddef14..5be73aa 100644 --- a/sec.logrotate +++ b/sec.logrotate @@ -3,6 +3,6 @@ notifempty sharedscripts postrotate - /usr/bin/systemctl kill --signal=USR2 --kill-whom=main sec.service 2>/dev/null || true + /sbin/service sec rotate >/dev/null 2>&1 || true endscript } diff --git a/sec.service b/sec.service deleted file mode 100644 index 7b05795..0000000 --- a/sec.service +++ /dev/null @@ -1,12 +0,0 @@ -[Unit] -Description=Simple Event Correlator script to filter log file entries -After=syslog.target - -[Service] -Type=forking -PIDFile=/run/sec.pid -ExecStart=/usr/bin/sec --detach --pid=/run/sec.pid $OPTIONS -EnvironmentFile=/etc/sysconfig/sec - -[Install] -WantedBy=multi-user.target diff --git a/sec.spec b/sec.spec index 1d6d6bb..4191272 100644 --- a/sec.spec +++ b/sec.spec @@ -1,26 +1,24 @@ Name: sec -Version: 2.9.4 -Release: 2%{?dist} +Version: 2.8.3 +Release: 1%{?dist} Summary: Simple Event Correlator script to filter log file entries -# Automatically converted from old format: GPLv2+ - review is highly recommended. -License: GPL-2.0-or-later +Group: System Environment/Daemons +License: GPLv2+ URL: https://simple-evcorr.github.io/ Source0: https://github.com/simple-evcorr/sec/releases/download/%{version}/sec-%{version}.tar.gz -Source1: sec.service -Source2: sec@.service +Source1: sec.sysconfig +Source2: sec.init Source3: sec.logrotate -Source4: sec.sysconfig -Source5: conf.README +Source4: conf.README BuildArch: noarch -BuildRequires: perl-generators -BuildRequires: systemd - +# The init script uses arrays, so we need bash +Requires: bash Requires: logrotate -Requires(post): systemd -Requires(preun): systemd -Requires(postun): systemd +Requires(post): chkconfig +Requires(postun): initscripts +Requires(preun): initscripts, chkconfig %description SEC is a simple event correlation tool that reads lines from files, named @@ -39,132 +37,60 @@ writing messages to pipes or files, etc. # Install SEC and its associated files install -D -m 0755 -p sec %{buildroot}%{_bindir}/sec install -D -m 0644 -p sec.man %{buildroot}%{_mandir}/man1/sec.1 -install -D -m 0644 -p %{SOURCE1} %{buildroot}%{_unitdir}/sec.service -install -D -m 0644 -p %{SOURCE2} %{buildroot}%{_unitdir}/sec@.service +install -D -m 0644 -p %{SOURCE1} %{buildroot}%{_sysconfdir}/sysconfig/sec install -D -m 0644 -p %{SOURCE3} %{buildroot}%{_sysconfdir}/logrotate.d/sec -install -D -m 0644 -p %{SOURCE4} %{buildroot}%{_sysconfdir}/sysconfig/sec -install -D -m 0644 -p %{SOURCE5} %{buildroot}%{_sysconfdir}/%{name}/README +install -D -m 0755 -p %{SOURCE2} %{buildroot}%{_initrddir}/sec +install -D -m 0644 -p %{SOURCE4} %{buildroot}%{_sysconfdir}/%{name}/README # Remove executable bits because these files get packed as docs chmod 0644 contrib/convert.pl contrib/swatch2sec.pl %post -%systemd_post sec.service +if [ $1 -eq 1 ]; then + /sbin/chkconfig --add sec +fi %preun -%systemd_preun sec.service +if [ $1 -eq 0 ]; then + /sbin/service sec stop >/dev/null 2>&1 + /sbin/chkconfig --del sec +fi %postun -%systemd_postun_with_restart sec.service +if [ $1 -eq 1 ]; then + /sbin/service sec condrestart >/dev/null 2>&1 +fi + +%clean +rm -rf %{buildroot} %files +%defattr(-,root,root,-) %doc ChangeLog COPYING README contrib/convert.pl contrib/itostream.c contrib/swatch2sec.pl %config(noreplace) %{_sysconfdir}/%{name} -%config(noreplace) %{_sysconfdir}/logrotate.d/sec %config(noreplace) %{_sysconfdir}/sysconfig/sec +%config(noreplace) %{_sysconfdir}/logrotate.d/sec +%{_initrddir}/sec %{_bindir}/sec %{_mandir}/man1/sec.1* -%{_unitdir}/sec.service -%{_unitdir}/sec@.service %changelog -* Fri Jul 17 2026 Fedora Release Engineering - 2.9.4-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild - -* Thu Feb 12 2026 Stefan Schulze Frielinghaus - 2.9.4-1 -- New upstream release -- Use systemctl kill - -* Sat Jan 17 2026 Fedora Release Engineering - 2.9.3-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - -* Fri Jul 25 2025 Fedora Release Engineering - 2.9.3-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild - -* Sun Jan 19 2025 Fedora Release Engineering - 2.9.3-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild - -* Sat Nov 02 2024 Stefan Schulze Frielinghaus - 2.9.3-1 -- New upstream release - -* Fri Jul 26 2024 Miroslav Suchý - 2.9.2-5 -- convert license to SPDX - -* Sat Jul 20 2024 Fedora Release Engineering - 2.9.2-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - -* Sat Jan 27 2024 Fedora Release Engineering - 2.9.2-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - -* Sat Jul 22 2023 Fedora Release Engineering - 2.9.2-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - -* Mon Jun 05 2023 Stefan Schulze Frielinghaus - 2.9.2-1 -- New upstream release - -* Sat Jan 21 2023 Fedora Release Engineering - 2.9.1-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - -* Sat Jul 23 2022 Fedora Release Engineering - 2.9.1-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - -* Wed May 04 2022 Stefan Schulze Frielinghaus - 2.9.1-1 -- New upstream release - -* Sat Jan 22 2022 Fedora Release Engineering - 2.9.0-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - -* Fri Jul 23 2021 Fedora Release Engineering - 2.9.0-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - -* Thu May 13 2021 Stefan Schulze Frielinghaus - 2.9.0-1 -- New upstream release - -* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek - 2.8.3-4 -- Rebuilt for updated systemd-rpm-macros - See https://pagure.io/fesco/issue/2583. - -* Wed Jan 27 2021 Fedora Release Engineering - 2.8.3-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - -* Wed Jul 29 2020 Fedora Release Engineering - 2.8.3-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - * Sat May 2 2020 Stefan Schulze Frielinghaus - 2.8.3-1 - New upstream release -* Thu Jan 30 2020 Fedora Release Engineering - 2.8.2-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - -* Fri Jul 26 2019 Fedora Release Engineering - 2.8.2-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild - * Mon Jun 3 2019 Stefan Schulze Frielinghaus - 2.8.2-1 - New upstream release - Clean up spec file -- Added an environment file /etc/sysconfig/sec in order to specify command line options - -* Sat Feb 02 2019 Fedora Release Engineering - 2.8.1-1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild * Wed Oct 3 2018 Stefan Schulze Frielinghaus - 2.8.1-0 - New upstream release -* Sun Sep 2 2018 Stefan Schulze Frielinghaus - 2.8.0-0 +* Sun Sep 02 2018 Stefan Schulze Frielinghaus - 2.8.0-0 - New upstream release -* Sat Jul 14 2018 Fedora Release Engineering - 2.7.12-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild - -* Fri Feb 09 2018 Fedora Release Engineering - 2.7.12-1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild - * Wed Dec 13 2017 Stefan Schulze Frielinghaus - 2.7.12-0 - New upstream release -* Thu Jul 27 2017 Fedora Release Engineering - 2.7.11-1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild - * Sun Feb 5 2017 Stefan Schulze Frielinghaus - 2.7.11-0 - New upstream release @@ -174,73 +100,37 @@ chmod 0644 contrib/convert.pl contrib/swatch2sec.pl * Sat Apr 2 2016 Stefan Schulze Frielinghaus - 2.7.9-0 - New upstream release -* Thu Feb 04 2016 Fedora Release Engineering - 2.7.8-1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild +* Wed Feb 3 2016 Stefan Schulze Frielinghaus - 2.7.8-1 +- Init script supports log rotation now * Sun Dec 6 2015 Stefan Schulze Frielinghaus - 2.7.8-0 - New upstream release -* Wed Oct 14 2015 Fedora Release Engineering - 2.7.7-2 -- While rotating logfiles do not do a full restart of the sec instance +* Wed Nov 11 2015 Stefan Schulze Frielinghaus - 2.7.7-3 +- Add an optional timeout to the init script rule stop -* Fri Jun 19 2015 Fedora Release Engineering - 2.7.7-1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild +* Sun Oct 25 2015 Stefan Schulze Frielinghaus - 2.7.7-2 +- Update init script in order to send SIGTERM instead of SIGKILL for stop rule + +* Wed Oct 14 2015 Stefan Schulze Frielinghaus - 2.7.7-1 +- While rotating logfiles do not do a full restart of the sec instance * Wed Feb 18 2015 Stefan Schulze Frielinghaus - 2.7.7-0 - New upstream release -* Tue Jul 15 2014 Stefan Schulze Frielinghaus - 2.7.6-0 +* Fri Jan 17 2014 Stefan Schulze Frielinghaus - 2.7.5-0 - New upstream release -* Sun Jun 08 2014 Fedora Release Engineering - 2.7.5-1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild - -* Thu Jan 16 2014 Stefan Schulze Frielinghaus - 2.7.5-0 -- New upstream release - -* Sun Aug 04 2013 Fedora Release Engineering - 2.7.4-1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild - -* Sat Jun 29 2013 Stefan Schulze Frielinghaus - 2.7.4-0 -- New upstream release - -* Sun Jun 2 2013 Stefan Schulze Frielinghaus - 2.7.3-0 +* Sun Jun 30 2013 Stefan Schulze Frielinghaus - 2.7.4-0 - New upstream release * Mon Apr 15 2013 Stefan Schulze Frielinghaus - 2.7.2-0 - New upstream release -* Fri Mar 15 2013 Stefan Schulze Frielinghaus - 2.7.1-0 +* Mon Mar 18 2013 Stefan Schulze Frielinghaus - 2.7.1-0 - New upstream release -* Thu Feb 14 2013 Fedora Release Engineering - 2.6.2-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild - -* Fri Aug 17 2012 Stefan Schulze Frielinghaus - 2.6.2-2 -- Apply latest packaging guidelines (systemd scriptlets for F18+) - -* Sat Jul 21 2012 Fedora Release Engineering - 2.6.2-1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild - -* Sun Feb 5 2012 Stefan Schulze Frielinghaus - 2.6.2-0 -- New upstream release - -* Sat Jan 14 2012 Fedora Release Engineering - 2.6.1-1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild - -* Mon Sep 19 2011 Stefan Schulze Frielinghaus - 2.6.1-0 -- New upstream release - -* Sat Jun 11 2011 Stefan Schulze Frielinghaus - 2.6.0-2 -- Upgrade to systemd - -* Sun Mar 20 2011 Stefan Schulze Frielinghaus - 2.6.0-1 -- New upstream release - -* Wed Feb 09 2011 Fedora Release Engineering - 2.5.3-1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild - -* Thu Dec 10 2009 Stefan Schulze Frielinghaus - 2.5.3-0 +* Mon Dec 21 2009 Stefan Schulze Frielinghaus - 2.5.3-0 - New upstream release * Tue Sep 29 2009 Stefan Schulze Frielinghaus - 2.5.2-1 diff --git a/sec.sysconfig b/sec.sysconfig index a240503..9c7ff58 100644 --- a/sec.sysconfig +++ b/sec.sysconfig @@ -1,19 +1,29 @@ -# Command line options for SEC - -OPTIONS="--conf=/etc/sec/*.sec --input=/var/log/messages --log=/var/log/sec --intevents" - -# This is an example config if multiple instances of SEC should be started. -# These settings should be used together with the systemd service file -# sec@.service -# which allows to run multiple sec instances. # +# Because SEC usage varies so widely from user to user, it is configured by +# default to not run. Please read `sec --help` for valid options to use in +# this configuration directive, or use the sample defaults included below. +# +# If you would like to run multiple instances of sec in order to track more +# than one log file, you can use also use $SEC_OPTIONS as an array. +# +# Also, please don't forget to read the sec man page or look at the +# configuration options for /etc/sec/. # -# Below you find an example configuration of two instances named FOO and BAR. -# The instances can be started via the commands -# systemctl start sec@FOO and systemctl start sec@BAR -# For further configuration options, consult the systemd file: -# /lib/systemd/system/sec@.service -#OPTIONS_FOO="--conf=/etc/sec/FOO/*.sec --input=/var/log/secure --log=/var/log/sec-FOO --intevents" +# +# Default: +# +# SEC_ARGS="-detach -conf=/etc/sec/*.sec -input=/var/log/messages -log=/var/log/sec -intevents -pid=/var/run/sec.pid" +# -#OPTIONS_BAR="--conf=/etc/sec/BAR/*.sec --input=/var/log/maillog --log=/var/log/sec-BAR --intevents" +# +# For Multiple instances of SEC, use something like: +# +# SEC_ARGS[0]="-detach -conf=/etc/sec/sys/*.sec -input=/var/log/messages -log=/var/log/sec -intevents -pid=/var/run/sec.sys.pid" +# +# SEC_ARGS[1]="-detach -conf=/etc/sec/mail/*.sec -input=/var/log/messages -log=/var/log/sec -intevents -pid=/var/run/sec.mail.pid" +# +# Time limit (in seconds) to wait for SEC to shutdown. +# Default value defined in /etc/init.d/functions (usually 3 seconds) +# +# SHUTDOWN_TIMELIMIT=60 diff --git a/sec@.service b/sec@.service deleted file mode 100644 index dbf83af..0000000 --- a/sec@.service +++ /dev/null @@ -1,12 +0,0 @@ -[Unit] -Description=Simple Event Correlator (instance %I) -After=syslog.target - -[Service] -Type=forking -PIDFile=/run/sec-%I.pid -ExecStart=/usr/bin/sec --detach --pid=/run/sec-%I.pid $OPTIONS_%I -EnvironmentFile=/etc/sysconfig/sec - -[Install] -WantedBy=multi-user.target diff --git a/sources b/sources index 30a16bf..e30ca73 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (sec-2.9.4.tar.gz) = e049ea61e52420faddc2ad3373d9ec65cc6187d59e89537d919eb0342688e494c3d9db334347dbaf9a42260930c99756d46ed3f9f015a38bd95f6959ded047d9 +SHA512 (sec-2.8.3.tar.gz) = 9eba7db0dfa3661a3ef4e8aad3eeef1db710784f7a71131991a06918cc4f5634577b8bff3f00fcc1c5d998bf0c1e80efe88e1c1df3f5530b6ab4905ff00f2269