Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to watch Apache logs for the absence of an event that should occur hourly. For instance it could be a string like: 123.123.123.123 GET /backup.tar.gz

It looks like existing code does not do this (looked at swatch and monit). I'm thinking the right solution is to write my own script which rereads the entire apache log hourly, but looks at timestamps. I'm just wondering if the solution is already out there.

share|improve this question
    
You can make use of an hourly cron job. When it runs, it will check the last few lines in your apache log file. However, you need to be careful about choosing the job time to allow the needed time for the request to get executed. –  Khaled Feb 25 '12 at 8:03
add comment

2 Answers

I think SEC can do this, but it needs to be monitoring it in real time. I can also recommend you nxlog (disclaimer: I'm affiliated) for checking such situations. This example could be tweaked to fit your needs. On the other hand writing such a script in perl wouldn't be that complex, but you need to take a few things into account in order to not generate false positives or miss an alert, and once more rules need to be added, you can easily find yourself stuck with development.

share|improve this answer
    
This is pretty interesting. I've never heard of NXLOG. What is SEC? –  rohit Feb 27 '12 at 19:53
    
SEC: simple-evcorr.sf.net –  b0ti Feb 29 '12 at 15:39
add comment

I coded a solution that works ok:

http://paste.engr.uconn.edu/index.php/view/bac517cc

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.