From owner-freebsd-questions  Wed Feb 28 22:27:12 2001
Delivered-To: freebsd-questions@freebsd.org
Received: from mail.texas.net (tcnet07-23.austin.texas.net [209.99.35.86])
	by hub.freebsd.org (Postfix) with ESMTP id 62D9E37B71B
	for <freebsd-questions@FreeBSD.ORG>; Wed, 28 Feb 2001 22:27:08 -0800 (PST)
	(envelope-from dread@mail.texas.net)
Received: (from dread@localhost)
	by mail.texas.net (8.11.1/8.11.1) id f216O7V10688;
	Thu, 1 Mar 2001 00:24:08 -0600 (CST)
	(envelope-from dread)
Message-ID: <XFMail.010301002259.dread@texas.net>
X-Mailer: XFMail 1.4.0 on FreeBSD
X-Priority: 3 (Normal)
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 8bit
MIME-Version: 1.0
In-Reply-To: <20010227102649.A37911@blackhelicopters.org>
Date: Thu, 01 Mar 2001 00:22:59 -0600 (CST)
From: Don Read <dread@texas.net>
To: Michael Lucas <mwlucas@blackhelicopters.org>
Subject: Re: "if syslogd message appears, email immediately" program?
Cc: freebsd-questions@FreeBSD.ORG,
	Fernando Gleiser <fgleiser@cactus.fi.uba.ar>
Sender: owner-freebsd-questions@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.ORG


On 27-Feb-01 Michael Lucas wrote:
> Fernando,
> 
> I've tried this before, and wound up with a perl process that sucked
> up megs of RAM.  This system runs for months without rebooting.
> 
> Also, what happens when the log rotates?
> 
> On Tue, Feb 27, 2001 at 12:27:52PM -0300, Fernando Gleiser wrote:
>> On Tue, 27 Feb 2001, Michael Lucas wrote:
>> 
>> > Hello,
>> > 
>> > I'm trying to find a program that watches syslogd continuously, and if
>> > a certain daemon makes a log entry it sends an email.
>> > 
>> > We need this in real time, so logsurfer (or any other cron process)
>> > won't do it.
>> > 
>> > Surely someone has written this before?
>> 
>> You can do that with a 20-less lines perl script. It is something like:
>> 
<snipo perlscript>

Wouldn't life be easy if you would add this in /etc/syslog.conf:

auth.notice             | /usr/bin/mail -s "Sombody SU'ed" root@mydomain.com

Regards,
-- 
Don Read                                         dread@texas.net
-- If you are going to sin, sin against God, not the bureaucracy. 
                  God will forgive you but the bureaucrats won't. 

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message