Linux Server Security, Second Edition

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

Using Swatch for Automated Log Monitoring

|

445

the same file. We haven’t associated different expressions with different watched

files, nor can we. But what if you want to watch more than one logfile?

This is no problem. Although each .swatchrc file may describe only one watched file,

there’s nothing to stop you from running multiple instances of Swatch, each with its

own .swatchrc file. In other words, .swatchrc is the default but not the required name

for Swatch configurations.

To split our two examples into two files, put the lines in Example 12-28 into a file

called, for example, .swatchrc.hterror, and the lines in Example 12-29 into a file

called .swatchrc.htaccess.

Advanced Swatch Configuration

So far, we’ve considered only actions we want triggered every time a given pattern is

matched. There are several ways we can control Swatch’s behavior with greater gran-

ularity.

The first and most obvious is to exploit regular expressions. Regular expressions,

which really constitute a text-formatting language of their own, are incredibly power-

ful and responsible for a good deal of the magic of Perl, sed, vi, and many other Unix

utilities.

It behooves you to know at least a couple “regex” tricks. Trick number one is called

alternation, and it adds a “logical or” to your regular expression ...