> Again, thanks for this great information. Here is another question from > a newbie: > > If I want one config file but two log files, i.e., the rules in the > config file pull from two different log files, what is the syntax for that? > > I now have the following two config files and, although I will fix up > the regex, they work. I'm assuming I can just paste them together like so: > > type=RegExp > ptype=RegExp > pattern=(user-9)@domain.com is now logged in > desc=successful FTP login for account $1 > action=pipe '$0' /bin/mail -s "$1 logged in!" [email protected] > type=Single > ptype=RegExp > pattern=sent \/home\/public\_html\/(.*)\/(.*) > desc=successful FTP download for account $1 file: $2 > action=pipe '$0' /bin/mail -s "Download by $1!" [email protected]
Actually, you can't paste rule together like that, but rule definitions need to be separated from each other by either a comment line or empty line (line which may contains whitespace only). > > but the first config get input from /var/log/messages and the second one gets > input from /var/log/pureftpd.log > > how does one tell sec to get input from two different log files while making > sure they get properly assigned to the right part of the config file? > > If you want to restrict a rule for matching messages from one log file only, you can use an internal context for that. Have a look at the --intcontexts command line option and INTERNAL EVENTS AND CONTEXTS section in the SEC man page (http://simple-evcorr.sourceforge.net/man.html#INTERNAL%20EVENTS%20AND%20CONTEXTS). kind regards, risto ------------------------------------------------------------------------------ Everyone hates slow websites. So do we. Make your web apps faster with AppDynamics Download AppDynamics Lite for free today: http://p.sf.net/sfu/appdyn_d2d_feb _______________________________________________ Simple-evcorr-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
