|
From: Michael G. <mg...@ee...> - 2000-12-13 16:01:58
|
Heh, my fault on this one. I goofed. Download 0.3.6 again. Heh. I forgot to add 5 lines of code =) You're my first tester to use the -noautodiscovery option. That problem should be all fixed. On Wed, Dec 13 @ 14:00, Edvard Majakari wrote: > On Wed, 13 Dec 2000, mg...@ee... wrote: > > I promise (yeah, sure) this is last stupid question concerning peep.. I > use version 0.3.6, and I just got it work fine from the remote host. But > only one thing - I cannot get the rooster sound for web pages. Also, > ssh-login, su and web seem to generate the same sounds, even as they > should use different sound files. > > Setup: I have peepd running (with no options) at machine A, > with the following /etc/peep.conf (comments removed to save space) > > --------/etc/peep.conf at machine A, where peepd is running------------------------ > > class text > broadcast broad.cast.address.0 > server my.FQDN:2001 > end class text > > client LogParser > class text test > port 2000 > config > # use postfix pattern because I don't use sendmail > out-mail O 0 1 "postfix.*:.*from=" > inc-mail I 255 0 "postfix.*:.*to=" > login L 128 0 "Login" > logout l 128 0 "Logout" > ssh-logins S 128 2 "(ssh).*opened" > bad-query Q 128 3 "unapproved query" > web W 128 0 "GET" > su U 128 255 "(su.*root)|(su: SU)" > badsu B 128 255 "BADSU" > end config > end client LogParser > > events > inc-mail /usr/local/share/peep/sounds/cleanpeep.* 1 > login /usr/local/share/peep/sounds/jay2.* 1 > out-mail /usr/local/share/peep/sounds/peep1a.* 2 > logout /usr/local/share/peep/sounds/croak.* 3 > ssh-logins /usr/local/share/peep/sounds/tink2a.* 1 # sound of ssh > web /home/ed/Peep-0.3.6/sounds/myrooster1.* 1 # web sound > su /usr/local/share/peep/sounds/unk12.* 1 # su sound > bad-query /usr/local/share/peep/sounds/unk15a.* 1 > badsu /usr/local/share/peep/sounds/unk7.* 1 > end events > > states > loadavg /usr/local/share/peep/sounds/water2.* 8 0.7 # Stream... standard > users /usr/local/share/peep/sounds/s-01-31-01-s.* 1 1.5 > something /usr/local/share/peep/sounds/leaves.* 4 0.7 > cricket /usr/local/share/peep/sounds/s-01-47-01-s.* 1 0.0 # needs fixing > end states > > ----------------------------------------------------------------------------------- > > Then, in the machine B I have both the Uptime and LogParser running as > follows: > > ./Uptime -server=machine.a.address -port=2001 > > This works well; I hear water running with intensity correlating to load > average. > > > But the LogParser - I don't know, it seems to work ok, it matches the > patterns and I hear noises.. except they are all the same. I run LogParser > as follows: > > <machine B> $ sudo ./LogParser -noautodiscovery -server <machine A> > -port 2001 -events="IOLlSQUBW" > -logfile="/var/log/auth.log,/var/log/syslog,/var/log/daemon.log,/var/log/mail.info,/var/log/apache/access.log" > > And I get > > ============================================================= > LogParser - Event producer for PEEP: the network auralizer > Copyright (c) 2000 Michael Gilfix > ============================================================= > Initializing PEEP library and retrieving config...(done) > Patterns Loaded: 9 > Scanning logs: > /var/log/auth.log > /var/log/syslog > /var/log/daemon.log > /var/log/mail.info > /var/log/apache/access.log > Found match: su: Dec 13 13:36:11... > Found match: web: ... "GET / HTTP/1.0" .. > Found match: ssh-logins: Dec 13 13:43:40 ... > > and I always get the same, short whistle. In machine B (where I run > LogParser) I have this peep.conf: > > > -------------- /etc/peep.conf at Machine B, where I run LogParser -------- > class text > broadcast broadcast.address > server machine.A.FQDN:2001 > end class text > > client LogParser > class text test > port 2000 > config > out-mail O 0 1 "postfix.*:.*from" > inc-mail I 255 0 "postfix.*:.*to=" > login L 128 0 "Login" > logout l 128 0 "Logout" > ssh-logins S 128 2 "(ssh).*opened" > web W 128 0 "GET" > bad-query Q 128 3 "unapproved query" > su U 128 255 "(su.*root)|(su: SU)" > badsu B 128 255 "BADSU" > end config > end client LogParser > > events > inc-mail /home/ed/Peep-0.3.6/sounds/cleanpeep.* 1 # fine.. > login /home/ed/Peep-0.3.6/sounds/jay2.* 1 # Great sound > out-mail /home/ed/Peep-0.3.6/sounds/peep1a.* 2 # Fine > logout /home/ed/Peep-0.3.6/sounds/croak.* 3 # 3 frog sounds. > web /home/ed/Peep-0.3.6/sounds/myrooster1.* 1 > ssh-logins /home/ed/Peep-0.3.6/sounds/tink2a.* 1 > su /home/ed/Peep-0.3.6/sounds/unk12.* 1 # The monkey bird. USE > bad-query /home/ed/Peep-0.3.6/sounds/unk15a.* 1 # This is great -hoarse > badsu /home/ed/Peep-0.3.6/sounds/unk7.* 1 # This is also great. USE > end events > > states > loadavg /home/ed/Peep-0.3.6/sounds/water2.* 8 0.7 # Stream... standard > users /home/ed/Peep-0.3.6/sounds/s-01-31-01-s.* 1 1.5 > something /home/ed/Peep-0.3.6/sounds/leaves.* 4 0.7 > cricket /home/ed/Peep-0.3.6/sounds/s-01-47-01-s.* 1 0.0 # needs fixing > end states > > -------------------------------------------------------------------------- > > Of course, all works fine if myrooster1.01, tink2a.01 and unk12.01 are all > the same-sounding files. > > -- > # Edvard 050 3691 463 http://www.uta.fi/~loedma/ > > -- rakastan, siis olen > _______________________________________________ > Peep-develop mailing list > Pee...@li... > http://lists.sourceforge.net/mailman/listinfo/peep-develop `-> (ed) -- Michael Gilfix mg...@ee... |