Wriet a shell script grep'ping out what you want from the
/var/log/messages and having it emailed to you.
Try this as an example (some lines may be wrapped):
#!/bin/sh
PATH=/bin:/usr/bin:/usr/local/bin:/sbin:/usr/sbin:/usr/local/sbin
# get the site parameters
if [ -e /etc/lannet-params ]; then
. /etc/lannet-params
case ${MANAGERLEVEL} in
2|3)
CC="-c ${MANAGERMAIL}";;
*)
CC=;;
esac
else
CLIENTMAIL="root@localhost"
CC=
fi
ipchains -L hain -vn >/tmp/hacct
ipchains -L haout -vn >>/tmp/hacct
cat /tmp/hacct | mail -s "** MANAGEMENT `uname -n` - Daily interface traffic stats"
${CC} ${CLIENTMAIL} 1>/dev/null
ipchains -L -Z -vxn >>/var/log/traffic.log
date >>/var/log/traffic.log
mv -f /tmp/today /tmp/yesterday
date +"%b %d" | sed -e "s/ 0/ /" > /tmp/today
grep "Packet log" /var/log/messages | grep -e DENY -e REJECT | grep "`cat
/tmp/yesterday`" | mail -s "** MANAGEMENT `uname -n` - Firewall log entries, denials
only" ${CC} ${CLIENTMAIL} 1>/dev/null
grep -e CONNECT -e BUSY /var/log/messages | grep -v \( | grep "`cat /tmp/yesterday`" |
mail -s "** MANAGEMENT `uname -n` - Reconnections" ${CC} ${CLIENTMAIL} 1>/dev/null
grep "`cat /tmp/yesterday`" /var/log/secure | mail -s "** MANAGEMENT `uname -n` -
Secure Logins" ${CC} ${CLIENTMAIL} 1>/dev/null
last | grep "`cat /tmp/yesterday`" | mail -s "** MANAGEMENT `uname -n` - Normal
logins" ${CC} ${CLIENTMAIL} 1>/dev/null
sendmail -q
Howard.
______________________________________________________
LANNet Computing Associates <http://www.lannet.com.au>
On Fri, 31 Mar 2000, Chris MacKenzie wrote:
> Hi All,
>
> Just a simple (I hope) query.
> I've currently got my ipchains logging to /var/log/messages and I also
> use logrotate to rotate the logs and email them each night. The problem
> I have is that after log rotate does it's thing, ipchains logging no
> longer works without re-running the rc.firewall script.
>
> Is there a better way than re-running rc.firewall in the post-rotate ?
>
> --
> Rgds,
> Chris MacKenzie
> [EMAIL PROTECTED]
>
> Windows 95/NT - 32 bit extensions and a graphical shell
> for a 16 bit patch to an 8 bit operating
> system originally coded for a 4 bit
> microprocessor, written by a 2 bit company
> that can't stand 1 bit of competition.
> --
> SLUG - Sydney Linux Users Group Mailing List - http://www.slug.org.au
> To unsubscribe send email to [EMAIL PROTECTED] with
> unsubscribe in the text
>
--
SLUG - Sydney Linux Users Group Mailing List - http://www.slug.org.au
To unsubscribe send email to [EMAIL PROTECTED] with
unsubscribe in the text
