Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What I want/need/desire is to log when a user logs into my FTP server.

Problem: I can't make swatch work the way I should be able to.

This data is logged to a file - but of course these logs are not kept very long. I can't keep the logs around forever, but I can extract data from then, analyze it, store results elsewhere.

If there is a better way to do this than the following, I'm all ears.

Swatch version 3.2.3

Perl 5.12


OS (Test): OS X 10.6.8

OS (Production): Solaris

From man I see I can pass contents to a command .. so I should be able to echo those values to file, do a sed/cut/uniq thing on them for stats.

$ man swatch
exec command
       Execute command. The command may contain variables which 
       are substituted with    fields from the matched line. A $N 
       will be replaced by the Nth field in
       the line. A $0 or $* will be replaced by the entire line.

Swatch file .swatchrc

watchfor /OK LOGIN/
 pipe "echo "0: $0 1:$1 2:$2 3:$3 4:$4 5:$5" >> /Users/bdunbar/dev/ftplog/output.txt"

Launch with

$ swatch -c /Users/bdunbar/.swatchrc --script-dir /Users/bdunbar/dev/ftplog -t /Users/bdunbar/dev/ftplog/vsftpd.log &


echo "Mon July  9 03:11:07 2012 [pid 14938] [aetech] OK LOGIN: Client """ >>  vsftpd.log

Results - it's echoing to TTY. This is not needed or desired on the server, but it does tell me things are working.

*** swatch version 3.2.3 (pid:25780) started at Mon Jul  9 15:23:33 CDT 2012

Mon July  9 03:11:07 2012 [pid 14938] [aetech] OK LOGIN: Client

Results - bad! I appear to not be sending the variables to text.

$ tail -f output.txt
0: /Users/bdunbar/dev/ftplog/.swatch_script.25780 1: 2: 3: 4: 5:
share|improve this question

The answer: man page is wrong.

Variable for 'entire line' is $_

So this will echo the entire line to terminal.

watchfor /OK LOGIN/
      exec echo $_

One could also send this to email, or in my case to a file for further analysis.

share|improve this answer

You are quoting the exec part of the man page but you are using actually the pipe command.

pipe command[,keep_open] 
    Pipe matched lines into command. Use the keep_open option to force
    the pipe to stay open until a different pipe action is run or until 
    swatch exits.

So change the pipe to exec and by my understanding it should work.

share|improve this answer
So I was. I've switched it around - same result. My problem seems to be that $0 is not, as claimed in man, the entire line but the shell being executed. – Brian Dunbar Jul 11 '12 at 15:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.