New upstream release

- Clean up spec file

.gitignore

@@ -0,0 +1,15 @@
+sec-2.5.3.tar.gz
+/sec-2.7.1.tar.gz
+/sec-2.7.2.tar.gz
+/sec-2.7.4.tar.gz
+/sec-2.7.5.tar.gz
+/sec-2.7.7.tar.gz
+/sec-2.7.8.tar.gz
+/sec-2.7.9.tar.gz
+/sec-2.7.10.tar.gz
+/sec-2.7.11.tar.gz
+/sec-2.7.12.tar.gz
+/sec-2.8.0.tar.gz
+/sec-2.8.1.tar.gz
+/sec-2.8.2.tar.gz
+/sec-2.8.3.tar.gz

Makefile

@@ -1,21 +0,0 @@
-# Makefile for source rpm: sec
-# $Id$
-NAME := sec
-SPECFILE = $(firstword $(wildcard *.spec))
-
-define find-makefile-common
-for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done
-endef
-
-MAKEFILE_COMMON := $(shell $(find-makefile-common))
-
-ifeq ($(MAKEFILE_COMMON),)
-# attept a checkout
-define checkout-makefile-common
-test -f CVS/Root && { cvs -Q -d $$(cat CVS/Root) checkout common && echo "common/Makefile.common" ; } || { echo "ERROR: I can't figure out how to checkout the 'common' module." ; exit -1 ; } >&2
-endef
-
-MAKEFILE_COMMON := $(shell $(checkout-makefile-common))
-endif
-
-include $(MAKEFILE_COMMON)

conf.README

@@ -0,0 +1,12 @@
+This is the SEC configuration directory. Because SEC usage varies so widely
+from user to user, this package is configured by default to not run.
+
+The commented-out default settings in /etc/sysconfig/sec will load any file in
+this directory with a .sec suffix. You can find several example rules at
+
+    https://github.com/simple-evcorr/rulesets
+
+and install the ones you want here (taking into account that the examples are
+generic and some of them may need to be tweaked to work with your setup). You
+should also read the SEC man page so you have at least a basic understanding of
+the SEC configuration commands.

sec.init

@@ -0,0 +1,117 @@
+#!/bin/bash
+#
+# sec           Start and stop SEC.
+#
+# chkconfig:    - 20 80
+# description:  Simple Event Correlator script to filter log file entries
+
+. /etc/rc.d/init.d/functions
+
+prog="sec"
+exec="/usr/bin/sec"
+lockfile="/var/lock/subsys/sec"
+
+[ -e /etc/sysconfig/$prog ] && . /etc/sysconfig/$prog
+
+start() {
+	[ -x $exec ] || exit 5
+	for n in `seq 0 $((${#SEC_ARGS[*]} - 1))`; do
+		echo -n $"Starting $prog instance "$(($n + 1))": "
+		daemon $exec ${SEC_ARGS[$n]}
+		RETVAL=$?
+		echo
+		[ $RETVAL -ne 0 ] && return $RETVAL
+	done
+	touch $lockfile
+	return $RETVAL
+}
+
+stop() {
+	echo -n $"Stopping $prog: "
+	if [ -z "$SHUTDOWN_TIMELIMIT" ]; then
+		killproc $prog
+	else
+		killproc -d $SHUTDOWN_TIMELIMIT $prog
+	fi
+	RETVAL=$?
+	echo
+	[ $RETVAL -eq 0 ] && rm -f $lockfile
+	return $RETVAL
+}
+
+restart() {
+	stop
+	start
+}
+
+reload() {
+	echo -n $"Reloading $prog: "
+	killproc $prog -HUP
+	RETVAL=$?
+	echo
+	return $RETVAL
+}
+
+rotate() {
+	echo -n $"Rotating $prog: "
+	killproc $prog -USR2
+	RETVAL=$?
+	echo
+	return $RETVAL
+}
+
+force_reload() {
+	restart
+}
+
+rh_status() {
+	status $prog
+}
+
+rh_status_q() {
+	rh_status >/dev/null 2>&1
+}
+
+dump() {
+	echo -n $"Dumping state of $prog in /tmp/sec.dump: "
+	killproc $prog -USR1
+	RETVAL=$?
+	echo
+	return $RETVAL
+}
+
+case "$1" in
+  start)
+	start
+	;;
+  stop)
+	stop
+	;;
+  restart)
+	restart
+	;;
+  condrestart|try-restart)
+	rh_status_q || exit 0
+	restart
+	;;
+  reload)
+	reload
+	;;
+  force-reload)
+	force_reload
+	;;
+  rotate)
+	rotate
+	;;
+  status)
+	rh_status
+	;;
+  dump)
+	dump
+	;;
+  *)
+	echo $"Usage: $0 {start|stop|restart|condrestart|try-restart|reload|force-reload|rotate|status|dump}"
+	exit 2
+esac
+
+exit $?

sec.logrotate

@@ -0,0 +1,8 @@
+/var/log/sec {
+    missingok
+    notifempty
+    sharedscripts
+    postrotate
+        /sbin/service sec rotate >/dev/null 2>&1 || true
+    endscript
+}

sec.spec

@@ -0,0 +1,194 @@
+Name:           sec
+Version:        2.8.3
+Release:        1%{?dist}
+Summary:        Simple Event Correlator script to filter log file entries
+Group:          System Environment/Daemons
+License:        GPLv2+
+URL:            https://simple-evcorr.github.io/
+Source0:        https://github.com/simple-evcorr/sec/releases/download/%{version}/sec-%{version}.tar.gz
+Source1:        sec.sysconfig
+Source2:        sec.init
+Source3:        sec.logrotate
+Source4:        conf.README
+BuildArch:      noarch
+
+# The init script uses arrays, so we need bash
+Requires:       bash
+Requires:       logrotate
+
+Requires(post):     chkconfig
+Requires(postun):   initscripts
+Requires(preun):    initscripts, chkconfig
+
+%description
+SEC is a simple event correlation tool that reads lines from files, named
+pipes, or standard input, and matches the lines with regular expressions,
+Perl subroutines, and other patterns for recognizing input events.
+Events are then correlated according to the rules in configuration files,
+producing output events by executing user-specified shell commands, by
+writing messages to pipes or files, etc.
+
+%prep
+%setup -q
+
+%build
+
+%install
+# Install SEC and its associated files
+install -D -m 0755 -p sec        %{buildroot}%{_bindir}/sec
+install -D -m 0644 -p sec.man    %{buildroot}%{_mandir}/man1/sec.1
+install -D -m 0644 -p %{SOURCE1} %{buildroot}%{_sysconfdir}/sysconfig/sec
+install -D -m 0644 -p %{SOURCE3} %{buildroot}%{_sysconfdir}/logrotate.d/sec
+install -D -m 0755 -p %{SOURCE2} %{buildroot}%{_initrddir}/sec
+install -D -m 0644 -p %{SOURCE4} %{buildroot}%{_sysconfdir}/%{name}/README
+
+# Remove executable bits because these files get packed as docs
+chmod 0644 contrib/convert.pl contrib/swatch2sec.pl
+
+%post
+if [ $1 -eq 1 ]; then
+        /sbin/chkconfig --add sec
+fi
+
+%preun
+if [ $1 -eq 0 ]; then
+        /sbin/service sec stop >/dev/null 2>&1
+        /sbin/chkconfig --del sec
+fi
+
+%postun
+if [ $1 -eq 1 ]; then
+        /sbin/service sec condrestart >/dev/null 2>&1
+fi
+
+%clean
+rm -rf %{buildroot}
+
+%files
+%defattr(-,root,root,-)
+%doc ChangeLog COPYING README contrib/convert.pl contrib/itostream.c contrib/swatch2sec.pl
+%config(noreplace) %{_sysconfdir}/%{name}
+%config(noreplace) %{_sysconfdir}/sysconfig/sec
+%config(noreplace) %{_sysconfdir}/logrotate.d/sec
+%{_initrddir}/sec
+%{_bindir}/sec
+%{_mandir}/man1/sec.1*
+
+%changelog
+* Sat May 2 2020 Stefan Schulze Frielinghaus <stefansf@fedoraproject.org> - 2.8.3-1
+- New upstream release
+
+* Mon Jun 3 2019 Stefan Schulze Frielinghaus <stefansf@fedoraproject.org> - 2.8.2-1
+- New upstream release
+- Clean up spec file
+
+* Wed Oct 3 2018 Stefan Schulze Frielinghaus <stefansf@fedoraproject.org> - 2.8.1-0
+- New upstream release
+
+* Sun Sep 02 2018 Stefan Schulze Frielinghaus <stefansf@fedoraproject.org> - 2.8.0-0
+- New upstream release
+
+* Wed Dec 13 2017 Stefan Schulze Frielinghaus <stefansf@fedoraproject.org> - 2.7.12-0
+- New upstream release
+
+* Sun Feb 5 2017 Stefan Schulze Frielinghaus <stefansf@fedoraproject.org> - 2.7.11-0
+- New upstream release
+
+* Fri Jun 24 2016 Stefan Schulze Frielinghaus <stefansf@fedoraproject.org> - 2.7.10-0
+- New upstream release
+
+* Sat Apr 2 2016 Stefan Schulze Frielinghaus <stefansf@fedoraproject.org> - 2.7.9-0
+- New upstream release
+
+* Wed Feb 3 2016 Stefan Schulze Frielinghaus <stefansf@fedoraproject.org> - 2.7.8-1
+- Init script supports log rotation now
+
+* Sun Dec 6 2015 Stefan Schulze Frielinghaus <stefansf@fedoraproject.org> - 2.7.8-0
+- New upstream release
+
+* Wed Nov 11 2015 Stefan Schulze Frielinghaus <stefansf@fedoraproject.org> - 2.7.7-3
+- Add an optional timeout to the init script rule stop
+
+* Sun Oct 25 2015 Stefan Schulze Frielinghaus <stefansf@fedoraproject.org> - 2.7.7-2
+- Update init script in order to send SIGTERM instead of SIGKILL for stop rule
+
+* Wed Oct 14 2015 Stefan Schulze Frielinghaus <stefansf@fedoraproject.org> - 2.7.7-1
+- While rotating logfiles do not do a full restart of the sec instance
+
+* Wed Feb 18 2015 Stefan Schulze Frielinghaus <stefansf@fedoraproject.org> - 2.7.7-0
+- New upstream release
+
+* Fri Jan 17 2014 Stefan Schulze Frielinghaus <stefansf@fedoraproject.org> - 2.7.5-0
+- New upstream release
+
+* Sun Jun 30 2013 Stefan Schulze Frielinghaus <stefansf@fedoraproject.org> - 2.7.4-0
+- New upstream release
+
+* Mon Apr 15 2013 Stefan Schulze Frielinghaus <stefansf@fedoraproject.org> - 2.7.2-0
+- New upstream release
+
+* Mon Mar 18 2013 Stefan Schulze Frielinghaus <stefansf@fedoraproject.org> - 2.7.1-0
+- New upstream release
+
+* Mon Dec 21 2009 Stefan Schulze Frielinghaus <stefansf@fedoraproject.org> - 2.5.3-0
+- New upstream release
+
+* Tue Sep 29 2009 Stefan Schulze Frielinghaus <stefan@seekline.net> - 2.5.2-1
+- New upstream release
+- SPEC file cleanup
+- Init script cleanup
+- Removed some examples because of licensing issues. Upstream has clarified
+  and changed most of the license tags to GPLv2. Additionally, upstream
+  will include the examples in the next release.
+- Removed a provide statement since a period was in the name and no other
+  package required that special name.
+
+* Sun Jul 26 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.4.1-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
+
+* Wed Feb 25 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.4.1-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
+
+* Thu Sep  4 2008 Tom "spot" Callaway <tcallawa@redhat.com> - 2.4.1-2
+- fix license tag
+
+* Mon May 28 2007 Chris Petersen <rpm@forevermore.net>                  2.4.1-1
+- Update to 2.4.1
+
+* Wed Dec 06 2006 Chris Petersen <rpm@forevermore.net>                  2.4.0-1
+- Update to 2.4.0
+
+* Mon Jun 12 2006 Chris Petersen <rpm@forevermore.net>                  2.3.3-4
+- Change group to keep rpmlint happy
+- Fix permissions on the logrotate script
+
+* Thu Jun 08 2006 Chris Petersen <rpm@forevermore.net>                  2.3.3-3
+- Clean up spec
+- Add ghost file entries for the default logfile and pid
+- Add logrotate script
+- Add more bleedingsnort examples
+- Add pid to sec.sysconfig and completely rewrite to handle multiple instances
+- Fix download URL
+- Fix echo log command in 001_init.sec
+- Rewrite sysV init script to handle multiple instances (based loosely on vsftpd)
+
+* Mon May 01 2006 Didier Moens <Didier.Moens@dmbr.UGent.be>             2.3.3-2
+- Change init script to not start by default in any runlevel
+
+* Fri Apr 28 2006 Didier Moens <Didier.Moens@dmbr.UGent.be>             2.3.3-1
+- Upgrade to upstream 2.3.3
+- Add status to init script
+
+* Thu Sep 22 2005 Didier Moens <Didier.Moens@dmbr.UGent.be>             2.3.2-4
+- Update Source locations
+
+* Thu Sep 22 2005 Didier Moens <Didier.Moens@dmbr.UGent.be>             2.3.2-3
+- Change permissions on /usr/bin/sec
+
+* Thu Sep 22 2005 Didier Moens <Didier.Moens@dmbr.UGent.be>             2.3.2-2
+- Create initial startup rulesets
+- Add examples
+- Refine init script
+
+* Wed Sep 21 2005 Didier Moens <Didier.Moens@dmbr.UGent.be>             2.3.2-1
+- First build

sec.sysconfig

@@ -0,0 +1,29 @@
+#
+# Because SEC usage varies so widely from user to user, it is configured by
+# default to not run.  Please read `sec --help` for valid options to use in
+# this configuration directive, or use the sample defaults included below.
+#
+# If you would like to run multiple instances of sec in order to track more
+# than one log file, you can use also use $SEC_OPTIONS as an array.
+#
+# Also, please don't forget to read the sec man page or look at the
+# configuration options for /etc/sec/.
+#
+
+#
+# Default:
+#
+# SEC_ARGS="-detach -conf=/etc/sec/*.sec -input=/var/log/messages -log=/var/log/sec -intevents -pid=/var/run/sec.pid"
+#
+
+#
+# For Multiple instances of SEC, use something like:
+#
+# SEC_ARGS[0]="-detach -conf=/etc/sec/sys/*.sec -input=/var/log/messages -log=/var/log/sec -intevents -pid=/var/run/sec.sys.pid"
+#
+# SEC_ARGS[1]="-detach -conf=/etc/sec/mail/*.sec -input=/var/log/messages -log=/var/log/sec -intevents -pid=/var/run/sec.mail.pid"
+#
+# Time limit (in seconds) to wait for SEC to shutdown.
+# Default value defined in /etc/init.d/functions (usually 3 seconds)
+#
+# SHUTDOWN_TIMELIMIT=60

sources

@@ -0,0 +1 @@
+SHA512 (sec-2.8.3.tar.gz) = 9eba7db0dfa3661a3ef4e8aad3eeef1db710784f7a71131991a06918cc4f5634577b8bff3f00fcc1c5d998bf0c1e80efe88e1c1df3f5530b6ab4905ff00f2269