One of the most usefull things to monitor with ESM is the syslog. ESMSyslog can do that with a few simple changes to your syslog configuration.
ESMSysLog communicates with syslogd with FIFOs. First you have to create the FIFOs. To do this run: (as root)
mkdir /var/esmsyslog cd /var/esmsyslog mkfifo emerg mkfifo alert mkfifo crit mkfifo err mkfifo warning mkfifo notice mkfifo info mkfifo debug chmod 600 *
Now you will have a nice set of FIFOs that are only readable by root. Next you have to tell syslogd to use those FIFOs with:
*.=emerg |/var/esmsyslog/emerg *.=alert |/var/esmsyslog/alert *.=crit |/var/esmsyslog/crit *.=err |/var/esmsyslog/err *.=warning |/var/esmsyslog/warning *.=notice |/var/esmsyslog/notice *.=info |/var/esmsyslog/info *.=debug |/var/esmsyslog/debug
Just put that in your /etc/syslog.conf file and your done. If you don't want to log error levels just use the -i option. Unlike previous versions this version of esmsyslog will loudly complain if it can't read all of the FIFOs.
Also please remember that there are security implications. If authpriv.* messages are sent via email anyone who intercepts the email may be able to get passwords. If possible use encryption in your senders.
To run ESMSysLog just add it to the /etc/esm directory. It's a daemon monitor so the type will be dmonitor.
-n, --notifylevel x
The notify level. If ESMSysLog recives a messge with a priority greater then x it will send a SIGUSR1 to esmd to make it check the status of all of the dmonitors. Defaults to 8 (ESM_LOG_EMERG)
Note that ESMSysLog wait 1 minute before actually notifying esmd so multiple messages won't trigger multiple system reports. (the wait time can be changed by --fc-wait-time option) It also won't notify esmd more then 1 time per half-hour. (This can be changed with the --fcint option) Often emergency messages come in big batches. We don't want to get a huge number of system reports. And what would happen if the act of sending the system report generated a emergency message? This way we won't get thousands of messages.
-m, --maxmsgs x
Don't record more then x messages. ESMSysLog saves all of the messages it recives untill esmd tells it to make a report. However if it keeps too many it may run out of memory. Defaults to 2048
Note that the more msgs there are the slower it is to make a report. On slow machines you may want to set maxmsgs to about 500 to avoid timeouts and excessive cpu usage.
If new messages come in while the buffer is full old messages at the end of the buffer will be deleted.
-s, --savepri x
If messages have to be deleted try to avoid deleteing messages with a priority greater then x. Instead messages with lower priorities will be deleted first. Defaults to 5 (err) If you set this too low ESMSysLog will search the whole buffer for low priority messages many times. Each time savepri will be set a little higher. If you set this too high you may lose important messages.
-i, --ignorepri x
If a message's priority is <= x the message is ignored. However regular expression matching is always done on all messages. Defaults to 2 (info)
--fcint x
esmd won't be forced to check the dmonitors more then 1 time per x seconds. Defaults to 30 minutes.
--fc-wait-time x
Before forcing esmd to check all of the monitors when esmsyslog gets a urgent message esmsyslog waits because urgent messages often come in batches. Defaults to 1 minute.
-x, --regex x
Match regular expression x. If a mesage matches it will be treated differently, usually automatically given a higher priority. Advanced expressions using [] and {} are supported. (internally the regcomp library function is used, if that's not available regular expressions are disabled)
-p x, --regexpri x
Automatically give matched expressions priority x. Defaults to emerg
Regular expression priority matching works like this. You first set the priority with -p, then you enter the list of expressions you want to match. For instance to match bar* and foo* and set them to priority warn you would use:
-p warn -x "bar*" -x "foo*"
You can extend this to multiple priorities by using multiple -p arguments. For instant if you wanted to set foo* and bar* to priority emerg but set fakefoo* and fakebar* to info you could use:
-p emerg -x "foo*" -x "bar*" -p info -x "fakefoo*" -x "fakebar*"
The expressions on the command line are tried from left to right.
-h, --help
Help of course.
-v, --version
Prints some version information. Index