|
From: Edvard M. <ed...@hy...> - 2000-12-13 12:00:21
|
On Wed, 13 Dec 2000, mg...@ee... wrote:
I promise (yeah, sure) this is last stupid question concerning peep.. I
use version 0.3.6, and I just got it work fine from the remote host. But
only one thing - I cannot get the rooster sound for web pages. Also,
ssh-login, su and web seem to generate the same sounds, even as they
should use different sound files.
Setup: I have peepd running (with no options) at machine A,
with the following /etc/peep.conf (comments removed to save space)
--------/etc/peep.conf at machine A, where peepd is running------------------------
class text
broadcast broad.cast.address.0
server my.FQDN:2001
end class text
client LogParser
class text test
port 2000
config
# use postfix pattern because I don't use sendmail
out-mail O 0 1 "postfix.*:.*from="
inc-mail I 255 0 "postfix.*:.*to="
login L 128 0 "Login"
logout l 128 0 "Logout"
ssh-logins S 128 2 "(ssh).*opened"
bad-query Q 128 3 "unapproved query"
web W 128 0 "GET"
su U 128 255 "(su.*root)|(su: SU)"
badsu B 128 255 "BADSU"
end config
end client LogParser
events
inc-mail /usr/local/share/peep/sounds/cleanpeep.* 1
login /usr/local/share/peep/sounds/jay2.* 1
out-mail /usr/local/share/peep/sounds/peep1a.* 2
logout /usr/local/share/peep/sounds/croak.* 3
ssh-logins /usr/local/share/peep/sounds/tink2a.* 1 # sound of ssh
web /home/ed/Peep-0.3.6/sounds/myrooster1.* 1 # web sound
su /usr/local/share/peep/sounds/unk12.* 1 # su sound
bad-query /usr/local/share/peep/sounds/unk15a.* 1
badsu /usr/local/share/peep/sounds/unk7.* 1
end events
states
loadavg /usr/local/share/peep/sounds/water2.* 8 0.7 # Stream... standard
users /usr/local/share/peep/sounds/s-01-31-01-s.* 1 1.5
something /usr/local/share/peep/sounds/leaves.* 4 0.7
cricket /usr/local/share/peep/sounds/s-01-47-01-s.* 1 0.0 # needs fixing
end states
-----------------------------------------------------------------------------------
Then, in the machine B I have both the Uptime and LogParser running as
follows:
./Uptime -server=machine.a.address -port=2001
This works well; I hear water running with intensity correlating to load
average.
But the LogParser - I don't know, it seems to work ok, it matches the
patterns and I hear noises.. except they are all the same. I run LogParser
as follows:
<machine B> $ sudo ./LogParser -noautodiscovery -server <machine A>
-port 2001 -events="IOLlSQUBW"
-logfile="/var/log/auth.log,/var/log/syslog,/var/log/daemon.log,/var/log/mail.info,/var/log/apache/access.log"
And I get
=============================================================
LogParser - Event producer for PEEP: the network auralizer
Copyright (c) 2000 Michael Gilfix
=============================================================
Initializing PEEP library and retrieving config...(done)
Patterns Loaded: 9
Scanning logs:
/var/log/auth.log
/var/log/syslog
/var/log/daemon.log
/var/log/mail.info
/var/log/apache/access.log
Found match: su: Dec 13 13:36:11...
Found match: web: ... "GET / HTTP/1.0" ..
Found match: ssh-logins: Dec 13 13:43:40 ...
and I always get the same, short whistle. In machine B (where I run
LogParser) I have this peep.conf:
-------------- /etc/peep.conf at Machine B, where I run LogParser --------
class text
broadcast broadcast.address
server machine.A.FQDN:2001
end class text
client LogParser
class text test
port 2000
config
out-mail O 0 1 "postfix.*:.*from"
inc-mail I 255 0 "postfix.*:.*to="
login L 128 0 "Login"
logout l 128 0 "Logout"
ssh-logins S 128 2 "(ssh).*opened"
web W 128 0 "GET"
bad-query Q 128 3 "unapproved query"
su U 128 255 "(su.*root)|(su: SU)"
badsu B 128 255 "BADSU"
end config
end client LogParser
events
inc-mail /home/ed/Peep-0.3.6/sounds/cleanpeep.* 1 # fine..
login /home/ed/Peep-0.3.6/sounds/jay2.* 1 # Great sound
out-mail /home/ed/Peep-0.3.6/sounds/peep1a.* 2 # Fine
logout /home/ed/Peep-0.3.6/sounds/croak.* 3 # 3 frog sounds.
web /home/ed/Peep-0.3.6/sounds/myrooster1.* 1
ssh-logins /home/ed/Peep-0.3.6/sounds/tink2a.* 1
su /home/ed/Peep-0.3.6/sounds/unk12.* 1 # The monkey bird. USE
bad-query /home/ed/Peep-0.3.6/sounds/unk15a.* 1 # This is great -hoarse
badsu /home/ed/Peep-0.3.6/sounds/unk7.* 1 # This is also great. USE
end events
states
loadavg /home/ed/Peep-0.3.6/sounds/water2.* 8 0.7 # Stream... standard
users /home/ed/Peep-0.3.6/sounds/s-01-31-01-s.* 1 1.5
something /home/ed/Peep-0.3.6/sounds/leaves.* 4 0.7
cricket /home/ed/Peep-0.3.6/sounds/s-01-47-01-s.* 1 0.0 # needs fixing
end states
--------------------------------------------------------------------------
Of course, all works fine if myrooster1.01, tink2a.01 and unk12.01 are all
the same-sounding files.
--
# Edvard 050 3691 463 http://www.uta.fi/~loedma/
-- rakastan, siis olen
|