
236
|
Chapter 9, Administration and Automation
#77 Send Email Alerts for System Events
HACK
HACK
#77
Send Email Alerts for System Events Hack #77
Track log entries and send an email to yourself when something looks
suspicious.
In “Make Applications Trigger On-Screen Alerts” [Hack #27] you used X11 On-
Screen Display (XOSD) to make system alerts (such as possible attempts to
break into the system) as visible as possible. As effective as that approach
can be, it doesn’t work very well if you’re not looking at your monitor when
the alert appears.
The next best thing is to have a program send you an email alert. This
“hack” is simply an explanation of how you can configure two different log
monitor programs,
swatch and logsentry, to send you email alerts.
Fortunately, if you use
swatch to monitor one of your logs for keywords, you
don’t have to settle for one method of notification. You can list several ways
to have
swatch notify you of an alert. For example, you can have swatch
check to see if the word “failure” appears in your authentication log (that
might indicate someone is trying to guess a password). Normally, it echoes
the log entry to the screen where you started
swatch. “Make Applications
Trigger On-Screen Alerts”
[Hack #27] explained how to make the log entry
appear on-screen. The following entry in the .swatchrc file does both of
these things and also sends you an email alert:
watchfor /failure/
echo ...