Introduction
In this lab, you will learn how to use the swatch command, a powerful tool for monitoring log files and setting up custom alerts in Linux. The lab covers understanding the swatch command, monitoring log files with swatch, and configuring swatch for specific alerts.
The swatch (System Wide Analyzer and Tracker) command is used to monitor system log files and trigger actions based on specific patterns or events. It can be configured to watch for specific log entries and perform various actions, such as sending notifications, executing scripts, or forwarding the log entries to other systems. The lab starts by installing the swatch package, which may require additional dependencies. The lab then guides you through creating a simple configuration file to watch for the word "error" in the log files and execute a command when a match is found.
Understand the swatch Command
In this step, you will learn about the swatch command, a powerful tool for monitoring log files and setting up custom alerts in Linux.
The swatch (System Wide Analyzer and Tracker) command is used to monitor system log files and trigger actions based on specific patterns or events. It can be configured to watch for specific log entries and perform various actions, such as sending notifications, executing scripts, or forwarding the log entries to other systems.
Let's start by installing the swatch package:
sudo apt-get update
sudo apt-get install -y swatch
Example output:
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following additional packages will be installed:
libconfig-inifiles-perl libconfig-tiny-perl libfile-tail-perl libio-socket-ssl-perl libnet-dns-perl libnet-ip-perl libnet-ssleay-perl libsys-syslog-perl
Suggested packages:
libconfig-auto-perl
The following NEW packages will be installed:
libconfig-inifiles-perl libconfig-tiny-perl libfile-tail-perl libio-socket-ssl-perl libnet-dns-perl libnet-ip-perl libnet-ssleay-perl libsys-syslog-perl swatch
0 upgraded, 8 newly installed, 0 to remove and 0 not upgraded.
Need to get 223 kB of archives.
After this operation, 1,031 kB of additional disk space will be used.
Do you want to continue? [Y/n]
The swatch command reads log files and checks each line for patterns specified in a configuration file. When a match is found, swatch can perform various actions, such as sending an email, executing a script, or logging the event.
To understand the basic usage of swatch, let's create a simple configuration file:
nano ~/project/swatch.config
Add the following content to the file:
## swatch.config
watchfor /error/
actions = echo "Error found: $_"
This configuration file tells swatch to watch for the word "error" in the log files and, when found, execute the echo command to print a message.
Now, let's run swatch to monitor the system log file:
swatch --config-file ~/project/swatch.config --tail /var/log/syslog
The --tail option tells swatch to continuously monitor the log file and watch for new entries.
Example output:
Error found: Apr 12 10:15:32 ubuntu sshd[1234]: error: could not open log file
In this example, swatch detected the word "error" in the /var/log/syslog file and executed the configured action to print a message.
The swatch command provides a wide range of options and configuration settings to customize the monitoring and alert behavior. In the next steps, you will learn how to configure swatch for more advanced use cases.
Monitor Log Files with swatch
In this step, you will learn how to use swatch to monitor specific log files and set up custom alerts.
First, let's create a sample log file that we can use for monitoring:
touch ~/project/sample.log
Now, let's update the swatch configuration file to monitor the sample log file:
nano ~/project/swatch.config
Add the following content to the file:
## swatch.config
watchfor /error/
actions = echo "Error found in sample.log: $_"
logfile = ~/project/sample.log
This configuration tells swatch to monitor the ~/project/sample.log file and look for the word "error". When an error is detected, swatch will execute the echo command to print a message.
To start monitoring the log file, run the following command:
swatch --config-file ~/project/swatch.config --tail ~/project/sample.log
The --tail option tells swatch to continuously monitor the log file and watch for new entries.
Now, let's simulate an error in the log file:
echo "This is an error message" >> ~/project/sample.log
You should see the following output in the swatch terminal:
Error found in sample.log: This is an error message
Swatch has detected the "error" keyword in the log file and executed the configured action.
You can customize the swatch configuration to monitor different log files, watch for specific patterns, and perform various actions, such as sending email notifications, executing scripts, or forwarding log entries to other systems.
Configure swatch for Specific Alerts
In this step, you will learn how to configure swatch to monitor specific log entries and set up custom alerts.
Let's start by creating a new configuration file for swatch:
nano ~/project/swatch_alerts.config
Add the following content to the file:
## swatch_alerts.config
watchfor /failed login/
actions = exec /home/labex/project/alert_script.sh
logfile = /var/log/auth.log
watchfor /CRON/
actions = exec /home/labex/project/cron_alert.sh
logfile = /var/log/syslog
In this configuration:
- The first rule watches for the phrase "failed login" in the
/var/log/auth.logfile and executes thealert_script.shscript when a match is found. - The second rule watches for the word "CRON" in the
/var/log/syslogfile and executes thecron_alert.shscript when a match is found.
Now, let's create the alert scripts:
nano ~/project/alert_script.sh
Add the following content to the file:
#!/bin/bash
echo "Security alert: Failed login attempt detected!" | mail -s "Security Alert" admin@example.com
This script sends an email to the admin@example.com address when a failed login attempt is detected.
nano ~/project/cron_alert.sh
Add the following content to the file:
#!/bin/bash
echo "Cron alert: Cron job executed" | mail -s "Cron Alert" admin@example.com
This script sends an email to the admin@example.com address when a cron job is executed.
Make the scripts executable:
chmod +x ~/project/alert_script.sh ~/project/cron_alert.sh
Now, start swatch to monitor the log files and trigger the configured alerts:
swatch --config-file ~/project/swatch_alerts.config --tail /var/log/auth.log /var/log/syslog
The --tail option tells swatch to continuously monitor the log files and watch for new entries.
To test the alerts, you can simulate a failed login attempt or trigger a cron job. Swatch will detect the events and execute the corresponding alert scripts.
Summary
In this lab, you learned about the swatch command, a powerful tool for monitoring log files and setting up custom alerts in Linux. You started by installing the swatch package and then created a simple configuration file to watch for the word "error" in the log files and execute a command when a match is found. You also learned how to monitor log files with swatch and configure it for specific alerts, such as sending notifications or executing scripts based on log events.
