John,
rsyslog is starting sec. If I use service to stop rsyslog, sec will stop.
If I use service to start rsyslog, sec starts up too.
[root@host]# ps -ef | grep rsyslog
root 4209 1 0 10:45 ? 00:00:00 /sbin/rsyslogd -i
/var/run/syslogd.pid
-
and
-
[root@host]# ps -ef | grep sec
root 4214 4209 0 10:45 ? 00:00:00 /bin/bash
/usr/local/bin/sec.sh
root 4216 4214 0 10:45 ? 00:00:00 /usr/bin/perl -w
/usr/bin/sec --conf=/etc/sec/sec.conf --notail --input=-
I am not sure how to check with the "kill -USR1" or where to check the dump
file.
Thanks.
On Tue, Jan 28, 2014 at 10:42 AM, John P. Rouillard <[email protected]>wrote:
>
> Hi James:
>
> In message
> <cabboveiljfthaenmhs9yojossqbfhh--crbuxsww3ner1_f...@mail.gmail.com> ,
> James Lertora writes:
> > [...]
> >If I point sec (/etc/sysconfig/sec) to the current days syslogs are at,
> >then life is good, so I need to use named pipes.
> >
> >I am using RHEL 6.5
> >rsyslogd -v
> >rsyslogd 7.4.9, compiled with:
> > FEATURE_REGEXP: Yes
> > FEATURE_LARGEFILE: No
> > GSSAPI Kerberos 5 support: Yes
> > FEATURE_DEBUG (debug build, slow code): No
> > 32bit Atomic operations supported: Yes
> > 64bit Atomic operations supported: Yes
> > Runtime Instrumentation (slow code): No
> > uuid support: Yes
> >-
> >SEC (Simple Event Correlator) 2.7.4
> >l
> >I have this in my rsyslog.conf:
> >Module (load="omprog")
> >*.* action(type="omprog"
> > binary="/usr/local/bin/sec.sh"
> > template="RSYSLOG_TraditionalFileFormat")
> >-
> >sec.sh contains:
> >#!/bin/bash
> >usr/bin/sec --conf=/etc/sec/sec.conf --notail --input=-
> >
> >But I cannot seem to get log messages to actually get handled by sec.
>
> Just to note, I assume usr/bin/sec is a typo and not what is in your
> .sh file?
>
> Also is sec being started by rsyslog? ps -ef should tell you that.
>
> Deos sending the running SEC a kill -USR1 and looking ta the dump file
> show that the input stream is open? Are there any events in the event
> buffer?
>
> --
> -- rouilj
> John Rouillard
> ===========================================================================
> My employers don't acknowledge my existence much less my opinions.
>
------------------------------------------------------------------------------
WatchGuard Dimension instantly turns raw network data into actionable
security intelligence. It gives you real-time visual feedback on key
security issues and trends. Skip the complicated setup - simply import
a virtual appliance and go from zero to informed in seconds.
http://pubads.g.doubleclick.net/gampad/clk?id=123612991&iu=/4140/ostg.clktrk
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
