1

I'm trying to watch Apache logs for the absence of an event that should occur hourly. For instance it could be a string like: 123.123.123.123 GET /backup.tar.gz

It looks like existing code does not do this (looked at swatch and monit). I'm thinking the right solution is to write my own script which rereads the entire apache log hourly, but looks at timestamps. I'm just wondering if the solution is already out there.

1
  • You can make use of an hourly cron job. When it runs, it will check the last few lines in your apache log file. However, you need to be careful about choosing the job time to allow the needed time for the request to get executed.
    – Khaled
    Feb 25, 2012 at 8:03

1 Answer 1

0

I think SEC can do this, but it needs to be monitoring it in real time. I can also recommend you nxlog (disclaimer: I'm affiliated) for checking such situations. This example could be tweaked to fit your needs. On the other hand writing such a script in perl wouldn't be that complex, but you need to take a few things into account in order to not generate false positives or miss an alert, and once more rules need to be added, you can easily find yourself stuck with development.

2
  • This is pretty interesting. I've never heard of NXLOG. What is SEC?
    – rohit
    Feb 27, 2012 at 19:53
  • SEC: simple-evcorr.sf.net
    – b0ti
    Feb 29, 2012 at 15:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .