Hi James:
In message
<cabboveiljfthaenmhs9yojossqbfhh--crbuxsww3ner1_f...@mail.gmail.com> ,
James Lertora writes:
> [...]
>If I point sec (/etc/sysconfig/sec) to the current days syslogs are at,
>then life is good, so I need to use named pipes.
>
>I am using RHEL 6.5
>rsyslogd -v
>rsyslogd 7.4.9, compiled with:
> FEATURE_REGEXP: Yes
> FEATURE_LARGEFILE: No
> GSSAPI Kerberos 5 support: Yes
> FEATURE_DEBUG (debug build, slow code): No
> 32bit Atomic operations supported: Yes
> 64bit Atomic operations supported: Yes
> Runtime Instrumentation (slow code): No
> uuid support: Yes
>-
>SEC (Simple Event Correlator) 2.7.4
>l
>I have this in my rsyslog.conf:
>Module (load="omprog")
>*.* action(type="omprog"
> binary="/usr/local/bin/sec.sh"
> template="RSYSLOG_TraditionalFileFormat")
>-
>sec.sh contains:
>#!/bin/bash
>usr/bin/sec --conf=/etc/sec/sec.conf --notail --input=-
>
>But I cannot seem to get log messages to actually get handled by sec.
Just to note, I assume usr/bin/sec is a typo and not what is in your
.sh file?
Also is sec being started by rsyslog? ps -ef should tell you that.
Deos sending the running SEC a kill -USR1 and looking ta the dump file
show that the input stream is open? Are there any events in the event
buffer?
--
-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.
------------------------------------------------------------------------------
WatchGuard Dimension instantly turns raw network data into actionable
security intelligence. It gives you real-time visual feedback on key
security issues and trends. Skip the complicated setup - simply import
a virtual appliance and go from zero to informed in seconds.
http://pubads.g.doubleclick.net/gampad/clk?id=123612991&iu=/4140/ostg.clktrk
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
