Hello All,
I have one Java process which is running as daemon, on some TCP/IP port.
Now I would like to find out particular line (which is pre-formatted) from
application's log file.
e.g. #~#~#LOGGER#~#~#....#~#~#..................#~#~#
When above line will found into log, it should mail me and execute one
shell script.
I have tried with below configuration on client side. (ossec agent)
ossec.conf
...
<localfile>
<log_format>syslog</log_format>
<location>/var/log/application/processor.log</location>
</localfile>
...
decoder.xml
...
<decoder name="logger">
<program_name>java</program_name>
</decoder>
<decoder name="logger-client">
<parent>logger</parent>
<prematch offset="after_parent">^#~#~#LOGGER</prematch>
<regex>^#~#~#(\.)#~#~#(\.)#~#~#(\.)#~#~#(\.)#~#~#(\.)#~#~#(\.)#~#~#(\.)#~#~#(\.)#~#~#(\.)#~#~#(\.)#~#~#</regex>
<order>srcip</order>
</decoder>
...
local_rules.xml
<group name="syslog">
<rule id="700005" level="0">
<decoded_as>logger</decoded_as>
<description>Custom LOGGER Found</description>
</rule>
</group>
Please help me out.
Thanks,
Chandrakant Solanki
--
---
You received this message because you are subscribed to the Google Groups
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
