diff options
| author | Jan Tuomi <jan@jantuomi.fi> | 2025-10-18 19:42:30 +0300 |
|---|---|---|
| committer | Jan Tuomi <jan@jantuomi.fi> | 2025-10-18 19:42:30 +0300 |
| commit | 468c528ccf05ec448328882e0ee7d69683666309 (patch) | |
| tree | f44c9d3c9656eef367a6665942b31751880b626c | |
| parent | a1579417e4258df5a2cb65cc752bd40d9498b654 (diff) | |
Improve log monitoring
| -rw-r--r-- | tasks/general.yml | 2 | ||||
| -rw-r--r-- | templates/usr_local_etc_pylogsentinel.conf.j2 | 15 |
2 files changed, 13 insertions, 4 deletions
diff --git a/tasks/general.yml b/tasks/general.yml index b561d2a..87e5a54 100644 --- a/tasks/general.yml +++ b/tasks/general.yml @@ -53,7 +53,7 @@ changed_when: false - name: Install pylogsentinel - shell: pip install pylogsentinel==0.2.1 --force --no-input + shell: pip install pylogsentinel==0.3.0 --force --no-input when: pylogsentinel_check.rc != 0 - name: Install pylogsentinel.conf diff --git a/templates/usr_local_etc_pylogsentinel.conf.j2 b/templates/usr_local_etc_pylogsentinel.conf.j2 index 8eb154a..74721ef 100644 --- a/templates/usr_local_etc_pylogsentinel.conf.j2 +++ b/templates/usr_local_etc_pylogsentinel.conf.j2 @@ -2,12 +2,21 @@ state_dir = /var/run/pylogsentinel max_block_size = 10M -[logs] -cmd = find / -type d -path '*/var/log' +[logs.standard] +cmd = find / -type f -path '*/var/log/*' ! -name 'access.log' ! -name '*.bz2' + +[logs.access] +cmd = find / -type f -name 'access.log' [action.default] cmd = echo -e "---------\nMatched $RULE_ID in $FILE at line $LINE, context:\n\n$CONTEXT\n" >> /tmp/pylogsentinel.daily [rule.error] description = Error-like conditions -pattern = /(error|fatal|exception|kill|crash)/i +pattern = /(error|fatal|exception|kill)/i +logs = standard + +[rule.access] +description = HTTP code >=500 in access log +pattern = /HTTP\/[0-9].[0-9]" 5[0-9][0-9]/ +logs = access |