From 28b9f0736e43d188abc8a5b63eee1e428cca2935 Mon Sep 17 00:00:00 2001
From: Jan Tuomi <jan@jantuomi.fi>
Date: Wed, 15 Oct 2025 09:21:37 +0300
Subject: Add pylogsentinel

---
 templates/etc_crontab.j2                                |  5 +++++
 templates/usr_local_bin_pylogsentinel-batch-email.sh.j2 | 14 ++++++++++++++
 templates/usr_local_etc_pylogsentinel.conf.j2           | 13 +++++++++++++
 3 files changed, 32 insertions(+)
 create mode 100644 templates/usr_local_bin_pylogsentinel-batch-email.sh.j2
 create mode 100644 templates/usr_local_etc_pylogsentinel.conf.j2

(limited to 'templates')

diff --git a/templates/etc_crontab.j2 b/templates/etc_crontab.j2
index affdf7d..de1f3c6 100644
--- a/templates/etc_crontab.j2
+++ b/templates/etc_crontab.j2
@@ -25,3 +25,8 @@ PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin
 5       3       *       *       *       root    logto /var/log/backup /usr/local/bin/backup snapshot prune-local
 # Send backup snapshots to remote every third day at 4:05 AM
 5       4       */3     *       *       root    logto /var/log/backup /usr/local/bin/backup send-to-remote prune-remote notify
+
+# Run pylogmonitor
+*/10    *       *       *       *       root    python -m pylogsentinel
+# Run pylogsentinel batch job once a day
+5       6       *       *       *       root    /usr/local/bin/pylogsentinel-batch-email.sh
diff --git a/templates/usr_local_bin_pylogsentinel-batch-email.sh.j2 b/templates/usr_local_bin_pylogsentinel-batch-email.sh.j2
new file mode 100644
index 0000000..d28efd9
--- /dev/null
+++ b/templates/usr_local_bin_pylogsentinel-batch-email.sh.j2
@@ -0,0 +1,14 @@
+#!/bin/sh
+
+FILE=/tmp/pylogsentinel.daily
+
+if [ ! -f "$FILE" ]; then
+    echo "Nothing to do"
+    exit 0
+fi
+
+echo "Sending email"
+cat "$FILE" | mail -s "pylogsentinel alert batch" root
+
+echo "Removing batch file"
+rm "$FILE"
diff --git a/templates/usr_local_etc_pylogsentinel.conf.j2 b/templates/usr_local_etc_pylogsentinel.conf.j2
new file mode 100644
index 0000000..8eb154a
--- /dev/null
+++ b/templates/usr_local_etc_pylogsentinel.conf.j2
@@ -0,0 +1,13 @@
+[system]
+state_dir = /var/run/pylogsentinel
+max_block_size = 10M
+
+[logs]
+cmd = find / -type d -path '*/var/log'
+
+[action.default]
+cmd = echo -e "---------\nMatched $RULE_ID in $FILE at line $LINE, context:\n\n$CONTEXT\n" >> /tmp/pylogsentinel.daily
+
+[rule.error]
+description = Error-like conditions
+pattern = /(error|fatal|exception|kill|crash)/i
-- 
cgit v1.3