What I want/need/desire is to log when a user logs into my FTP server.

Problem: I can't make swatch work the way I should be able to.

This data is logged to a file - but of course these logs are not kept very long. I can't keep the logs around forever, but I can extract data from then, analyze it, store results elsewhere.

If there is a better way to do this than the following, I'm all ears.

Swatch version 3.2.3

Perl 5.12


OS (Test): OS X 10.6.8

OS (Production): Solaris

From man I see I can pass contents to a command .. so I should be able to echo those values to file, do a sed/cut/uniq thing on them for stats.

$ man swatch
exec command
       Execute command. The command may contain variables which 
       are substituted with    fields from the matched line. A $N 
       will be replaced by the Nth field in
       the line. A $0 or $* will be replaced by the entire line.

Swatch file .swatchrc

watchfor /OK LOGIN/
 pipe "echo "0: $0 1:$1 2:$2 3:$3 4:$4 5:$5" >> /Users/bdunbar/dev/ftplog/output.txt"

Launch with

$ swatch -c /Users/bdunbar/.swatchrc --script-dir /Users/bdunbar/dev/ftplog -t /Users/bdunbar/dev/ftplog/vsftpd.log &


echo "Mon July  9 03:11:07 2012 [pid 14938] [aetech] OK LOGIN: Client """ >>  vsftpd.log

Results - it's echoing to TTY. This is not needed or desired on the server, but it does tell me things are working.

*** swatch version 3.2.3 (pid:25780) started at Mon Jul  9 15:23:33 CDT 2012

Mon July  9 03:11:07 2012 [pid 14938] [aetech] OK LOGIN: Client

Results - bad! I appear to not be sending the variables to text.

$ tail -f output.txt
0: /Users/bdunbar/dev/ftplog/.swatch_script.25780 1: 2: 3: 4: 5:

The answer: man page is wrong.

Variable for 'entire line' is $_

So this will echo the entire line to terminal.

watchfor /OK LOGIN/
      exec echo $_

One could also send this to email, or in my case to a file for further analysis.

| improve this answer | |

I know this may be late, but i had the same problem and found the reason. You must use capturing groups in the regular expression (that's what the numbers refer to).


/OK LOGIN: Client (.*)/

$1 will represent the client IP address in your example.

| improve this answer | |

You are quoting the exec part of the man page but you are using actually the pipe command.

pipe command[,keep_open] 
    Pipe matched lines into command. Use the keep_open option to force
    the pipe to stay open until a different pipe action is run or until 
    swatch exits.

So change the pipe to exec and by my understanding it should work.

| improve this answer | |
  • So I was. I've switched it around - same result. My problem seems to be that $0 is not, as claimed in man, the entire line but the shell being executed. – Brian Dunbar Jul 11 '12 at 15:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.