From 468c528ccf05ec448328882e0ee7d69683666309 Mon Sep 17 00:00:00 2001 From: Jan Tuomi Date: Sat, 18 Oct 2025 19:42:30 +0300 Subject: Improve log monitoring --- templates/usr_local_etc_pylogsentinel.conf.j2 | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) (limited to 'templates') diff --git a/templates/usr_local_etc_pylogsentinel.conf.j2 b/templates/usr_local_etc_pylogsentinel.conf.j2 index 8eb154a..74721ef 100644 --- a/templates/usr_local_etc_pylogsentinel.conf.j2 +++ b/templates/usr_local_etc_pylogsentinel.conf.j2 @@ -2,12 +2,21 @@ state_dir = /var/run/pylogsentinel max_block_size = 10M -[logs] -cmd = find / -type d -path '*/var/log' +[logs.standard] +cmd = find / -type f -path '*/var/log/*' ! -name 'access.log' ! -name '*.bz2' + +[logs.access] +cmd = find / -type f -name 'access.log' [action.default] cmd = echo -e "---------\nMatched $RULE_ID in $FILE at line $LINE, context:\n\n$CONTEXT\n" >> /tmp/pylogsentinel.daily [rule.error] description = Error-like conditions -pattern = /(error|fatal|exception|kill|crash)/i +pattern = /(error|fatal|exception|kill)/i +logs = standard + +[rule.access] +description = HTTP code >=500 in access log +pattern = /HTTP\/[0-9].[0-9]" 5[0-9][0-9]/ +logs = access -- cgit v1.3