From 468c528ccf05ec448328882e0ee7d69683666309 Mon Sep 17 00:00:00 2001
From: Jan Tuomi <jan@jantuomi.fi>
Date: Sat, 18 Oct 2025 19:42:30 +0300
Subject: Improve log monitoring

---
 tasks/general.yml                             |  2 +-
 templates/usr_local_etc_pylogsentinel.conf.j2 | 15 ++++++++++++---
 2 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/tasks/general.yml b/tasks/general.yml
index b561d2a..87e5a54 100644
--- a/tasks/general.yml
+++ b/tasks/general.yml
@@ -53,7 +53,7 @@
   changed_when: false
 
 - name: Install pylogsentinel
-  shell: pip install pylogsentinel==0.2.1 --force --no-input
+  shell: pip install pylogsentinel==0.3.0 --force --no-input
   when: pylogsentinel_check.rc != 0
 
 - name: Install pylogsentinel.conf
diff --git a/templates/usr_local_etc_pylogsentinel.conf.j2 b/templates/usr_local_etc_pylogsentinel.conf.j2
index 8eb154a..74721ef 100644
--- a/templates/usr_local_etc_pylogsentinel.conf.j2
+++ b/templates/usr_local_etc_pylogsentinel.conf.j2
@@ -2,12 +2,21 @@
 state_dir = /var/run/pylogsentinel
 max_block_size = 10M
 
-[logs]
-cmd = find / -type d -path '*/var/log'
+[logs.standard]
+cmd = find / -type f -path '*/var/log/*' ! -name 'access.log' ! -name '*.bz2'
+
+[logs.access]
+cmd = find / -type f -name 'access.log'
 
 [action.default]
 cmd = echo -e "---------\nMatched $RULE_ID in $FILE at line $LINE, context:\n\n$CONTEXT\n" >> /tmp/pylogsentinel.daily
 
 [rule.error]
 description = Error-like conditions
-pattern = /(error|fatal|exception|kill|crash)/i
+pattern = /(error|fatal|exception|kill)/i
+logs = standard
+
+[rule.access]
+description = HTTP code >=500 in access log
+pattern = /HTTP\/[0-9].[0-9]" 5[0-9][0-9]/
+logs = access
-- 
cgit v1.3