d106b2f2cd
- SPEC file cleanup
- Init script cleanup
- Removed some examples because of licensing issues. Upstream has clarified
and changed most of the license tags to GPLv2. Additionally, upstream
will include the examples in the next release.
- Removed a provide statement since a period was in the name and no other
package required that special name.
59 lines
1.5 KiB
Text
59 lines
1.5 KiB
Text
#
|
|
# SEC rules to pick up disruptive monitoring
|
|
# events.
|
|
#
|
|
# from http://sixshooter.v6.thrupoint.net/SEC-examples/article.html
|
|
#
|
|
# Copyright (C) 2003-2009 Jim Brown
|
|
# This is free software. You may redistribute copies of it under the terms of
|
|
# the GNU General Public License version 2.
|
|
# There is NO WARRANTY, to the extent permitted by law.
|
|
#
|
|
#Logs involving syslogd disabled or unusual promiscuous mode (MONITOR)
|
|
#----------------------------------------------------------------------
|
|
#Nov 15 20:02:48 foohost syslogd: exiting on signal 15
|
|
#Nov 22 02:00:02 foohost syslogd: restart
|
|
#Nov 11 15:58:55 foohost /kernel: de0: promiscuous mode enabled
|
|
#Nov 11 15:58:57 foohost /kernel: de0: promiscuous mode disabled
|
|
#
|
|
|
|
#
|
|
# Syslog Exit
|
|
# -----------
|
|
#
|
|
type=Single
|
|
ptype=RegExp
|
|
pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+syslogd: exiting on signal (\d+)
|
|
desc=$0
|
|
action=write - MONITOR: $1 syslog exit on signal $2 at %t
|
|
|
|
#
|
|
# Syslog Restart
|
|
# ---------------
|
|
#
|
|
type=Single
|
|
ptype=RegExp
|
|
pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+syslogd: restart
|
|
desc=$0
|
|
action=write - MONITOR: $1 syslog restart at %t
|
|
|
|
#
|
|
# Syslog Exit
|
|
# -----------
|
|
#
|
|
type=Single
|
|
ptype=RegExp
|
|
pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: (\S+) promiscuous mode (\S+)
|
|
desc=$0
|
|
action=write - MONITOR: $1 $2 promiscuous mode $3 at %t
|
|
|
|
#
|
|
# Swapspace failure
|
|
#
|
|
|
|
type=Single
|
|
ptype=RegExp
|
|
pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+kernel: swap_pager_getswapspace\(\S\): .*
|
|
desc=$0
|
|
action=pipe '$1 GET SWAP FAILURE: %s' /usr/bin/mail -s "SWAP SPACE FAIL on $1" alerts@example.com
|
|
|