Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to watch Apache logs for the absence of an event that should occur hourly. For instance it could be a string like: GET /backup.tar.gz

It looks like existing code does not do this (looked at swatch and monit). I'm thinking the right solution is to write my own script which rereads the entire apache log hourly, but looks at timestamps. I'm just wondering if the solution is already out there.

share|improve this question
You can make use of an hourly cron job. When it runs, it will check the last few lines in your apache log file. However, you need to be careful about choosing the job time to allow the needed time for the request to get executed. – Khaled Feb 25 '12 at 8:03

I think SEC can do this, but it needs to be monitoring it in real time. I can also recommend you nxlog (disclaimer: I'm affiliated) for checking such situations. This example could be tweaked to fit your needs. On the other hand writing such a script in perl wouldn't be that complex, but you need to take a few things into account in order to not generate false positives or miss an alert, and once more rules need to be added, you can easily find yourself stuck with development.

share|improve this answer
This is pretty interesting. I've never heard of NXLOG. What is SEC? – rohit Feb 27 '12 at 19:53
SEC: – b0ti Feb 29 '12 at 15:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.