Linux Server Security, Second Edition

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

Using Swatch for Automated Log Monitoring

|

441

Once Makefile.PL has successfully created a Makefile for Swatch, you can execute the

following commands to build and install it:

make

make test

make install

make realclean

The make test command is optional but useful: it ensures that Swatch can properly

use the Perl modules we just went to the trouble of installing. If these tests fail, check

out the “Help” forum at the Swatch site; when I built Swatch 3.1.1 on my SUSE 9.0

system, it initially failed, but thanks to the Help forum, I realized I was simply miss-

ing the File::Tail Perl module.

Swatch Configuration in Brief

Since the whole point of Swatch is to simplify our lives, configuring Swatch itself is,

well, simple. Swatch is controlled by a single file, $HOME/.swatchrc, by default. This

file contains text patterns, in the form of regular expressions, that you want Swatch

to watch for. Each regular expression is followed by the action(s) you wish to Swatch

to take whenever it encounters that text.

For example, suppose you’ve got an Apache-based web server and you want to be

alerted any time someone attempts a buffer-overflow attack by requesting an

extremely long filename (URL). By trying this attack yourself against the web server

while tailing its /var/apache/error.log, you know that ...