templates/usr_local_etc_pylogsentinel.conf.j2


1
2
3
4
5
6
7
8
9
10
11
12
13

[system]
state_dir = /var/run/pylogsentinel
max_block_size = 10M

[logs]
cmd = find / -type d -path '*/var/log'

[action.default]
cmd = echo -e "---------\nMatched $RULE_ID in $FILE at line $LINE, context:\n\n$CONTEXT\n" >> /tmp/pylogsentinel.daily

[rule.error]
description = Error-like conditions
pattern = /(error|fatal|exception|kill|crash)/i