Linux Server Security, Second Edition

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

446

|

Chapter 12: System Log Management and Monitoring

event, which I want to know about via console messages during weekdays, but

which I’ll need email messages to know about during the weekend.

The syntax of the

when= option is when=range_of_days:range_of_hours. Thus, in

Example 12-30, we see that any time the message “file system full” is logged, Swatch

will echo the log entry to the console in red ink. It will also send email, but only if it’s

Saturday (

7) or Sunday (1).

Running Swatch

Swatch expects .swatchrc to live in the home directory of the user who invokes

swatch. Swatch also keeps its temporary files there by default. (Each time it’s

invoked, it creates and runs a script called a watcher process, whose name ends with

a dot followed by the PID of the swatch process that created it).

The

-c path/to/configfile and --script-dir=/path/to/scripts flags let you specify

alternate locations for Swatch’s configuration and script files, respectively. Never

keep either in a world-writable directory, however. In fact, only these files’ owners

should be able to read them.

For example, to invoke Swatch so that it reads my custom configuration file in /var/

log and also uses that directory for its watcher-process script, I’d use the command

listed in Example 12-30.

I also need to tell Swatch