-
Hi, skendric
Thank you so much for your help. I'll try to use logrotate.
2009-09-14 13:40:45 UTC by xelan
-
Hi Xelan,
-I don't think that watching binary files with swatch will do anything useful ... swatch searches for ASCII strings ... the binary file will contain text that has been converted into some binary format ... there are zillions of binary formats ... you would need to convert the ASCII string you cared about into this particular binary format and then search on it ... I'm skeptical that...
2009-09-08 18:57:35 UTC by skendric
-
by the way, is it possible to analyse binary files with swatch? if it's possible how can I do it?.
2009-09-04 21:34:21 UTC by xelan
-
how can I delete it?(.
2009-09-04 21:32:36 UTC by xelan
-
Hello ,
I'm using swatch to send Snort's alerts by email.
So the situation is following: there is a one program which constantly write events to "alert" file and swatch is tracking them.
I'm concerned about growing size of this alert file and looking for a better way to solve this problem. I'm very new to Linux and spent all the day trying to find a solution.
These are my ideas...
2009-09-04 21:31:45 UTC by xelan
-
1.
2009-09-04 21:28:04 UTC by xelan
-
Apoplogies for the repeat.
2009-07-20 21:08:29 UTC by mengel
-
To support scheduled downtimes, I would like to add two more type= keywords to "threshold" -- "known_down" and "known_up".
Then you can syslog a message saying that a scheduled downtime is starting, triggering 'threshold track_by=whatever known_down',
and all the actions for 'whatever' which would then come along until you do "threshold track_by=whatever known_up" would be squelched.
I'm...
2009-07-20 21:07:42 UTC by mengel
-
To support scheduled downtimes, I would like to add two more type= keywords to "threshold" -- "known_down" and "known_up".
Then you can syslog a message saying that a scheduled downtime is starting, triggering 'threshold track_by=whatever known_down',
and all the actions for 'whatever' which would then come along until you do "threshold track_by=whatever known_up" would be squelched.
I'm...
2009-07-20 20:53:38 UTC by mengel
-
I've added a feature for the mail Action to group together messages in a single mail based on a rate-limit on emails.
See http://lendl.priv.at/blog/2009/07/06/rate-limit-for-swatch/ for the description and the code.
2009-07-06 15:14:35 UTC by otmar
