--- Jeremiah Roth <[EMAIL PROTECTED]> wrote: > Hello, > > First, I'm an SEC newbie... > > I have a service (freeradius w/jradius) that stops > working one of two > ways - the first is that it dies cleanly with the > log stating it's > shutting down jradius connections. This one is easy > to catch with > SEC, obviously. The second way is that it just > stops working, and > logging, even though the process is still running. > The radius server > gets enough traffic that I should see something > every minute in the > log, but I'd like to alert (via a script) when it > hasn't logged > anything for a period of time. As I see it it's the > opposite of what > SEC is designed for.
Actually, there is a relevant example in the SEC man page: http://kodu.neti.ee/~risto/sec/sec.pl.html#lbAY > Is this possible with SEC? > > I've searched the archives, but haven't found > anything - though I > might be searching for the wrong terms. All you have to do is to employ Calendar rule for checking the presence of Radius log messages. Suppose that Radius messages are written to syslog, and they look like this: <date> <hostname> radius[<pid>]: <message> Then the ruleset might look like this: type=Calendar time=* * * * * desc=CHECK FOR RADIUS MESSAGES action=event %s type=PairWithWindow ptype=SubStr pattern=CHECK FOR RADIUS MESSAGES desc=radius daemon has stopped working! action=logonly %s ptype2=RegExp pattern2=radius\[\d+\]: desc2=radius daemon is OK action2=none window=120 This ruleset checks for the presence of Radius messages in the log once a minute, and if no messages have been seen in 2 minutes, an alert is logged. hth, risto > > Thanks, > -Jeremiah > > > > ------------------------------------------------------------------------- > This SF.net email is sponsored by the 2008 > JavaOne(SM) Conference > Don't miss this year's exciting event. There's still > time to save $100. > Use priority code J8TL2D2. > http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone > _______________________________________________ > Simple-evcorr-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users > ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ ------------------------------------------------------------------------- This SF.net email is sponsored by the 2008 JavaOne(SM) Conference Don't miss this year's exciting event. There's still time to save $100. Use priority code J8TL2D2. http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone _______________________________________________ Simple-evcorr-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
