monitoring svlogd-produced logfiles

[Vincent Danen <vdanen@linsec.ca>]

[-- Attachment #1: Type: text/plain, Size: 1901 bytes --]

Quick question here... is anyone using anything like swatch or SEC to
parse/monitor svlogd-produced logfiles?  I'm having some issues with
tail where it won't follow ./current when it rotates, which is causing
me some grief.  I ended up solving it to some extent using the perl
File::Tail module with swatch, but I'm not overly satisfied with the
results, because swatch will now only let me monitor a single logfile
rather than two (my catchall log and the kernel log from socklog), and
on my loghost I need it to look at probably a dozen logs.

So I'm looking for a good alternative that properly follows ./current
(or reloads it on rotation) and can handle multiple logfiles.

There's a whole bunch of different programs out there so I'm hoping that
someone can share what they're using to save me some time.  I'm
currently looking at SEC, and it seems quite powerful.

The other thing I was considering was to see if I could make svlogd
write to one end of a named pipe and have the log watcher on the end,
avoiding disk writes completely (and let the log watcher write
"summarized" logs).  This would be a benefit when having two "*.*"
services, one writing the logs and the other writing them to the named
pipe.  But I'm not sure if named pipes are exclusive, i.e. can I have
multiple svlogd processes writing to the same named pipe at the same
time?

Ideally, the log watcher should be able to run supervised as well
because although I'd like to watch it realtime (I like swatch's
colorized output), I'd like it to also write the "summary" log as well,
which would be retained for a longer period of time than the standard
logs.

Any suggestions?

Thanks in advance.

-- 
{FEE30AD4 : 7F6C A60C 06C2 4811 FA1C  A2BC 2EBC 5E32 FEE3 0AD4}
mysql> SELECT * FROM users WHERE clue > 0;
Empty set (0.00sec)
:: Annvix - Secure Linux Server: http://annvix.org/ ::

[-- Attachment #2: Type: application/pgp-signature, Size: 186 bytes --]