お世話様です。MiwaYonedaと申します。
swatch-3.0.1-3を使用しています。swatch起動時にエラーが出て困ってますので質問
させて下さい。
[root@rh9]# cat /etc/swatch/swatchrc
# /Authentication failed/ mail=hoge
# Bad login attempts
/INVALID|REPEATED|INCOMPLETE/ mail=hoge
# System crashes and halts
/(panic|halt)/ mail=hoge
# syslog warning message
/err/ mail=hoge
/denied/ mail=hoge
/fail/ mail=hoge
#/warning/ mail=hoge
#/(INVALID|Invalid|invalid)/ mail=hoge
#/Warn/ mail=hoge
/(FAIL|Fail|fail)/ mail=hoge:hoehoe@xxxxxxxxxxxx
/refuse/ mail=hoge
/deferral/ mail=hoge
#login認証に3度失敗
watchfor /3 more authentication failures/
echo
mail=hoge,subject=swatch_login_log
#ssh接続で認証失敗
watchfor /sshd.*reject/
bell 3
write root
mail=hoge,subject=swatch_sshd_log
#FTP接続で認証失敗
#ftpd
watchfor /ftpd.*authentication failure/
bell
echo
mail=hoge,subject=swatch_ftpd_log
# ポートスキャンなど
watchfor /(null connection|eof received)/
mail=hoge,subject=swatch_portScan_log
/Bogus PPPoE length field/ exec=/etc/myScript/BogusPPPoElengthField.sh
mail=hoge
と記述してます。そして、
[root@rh9]# cat /etc/rc.d/init.d/swatch.sh
#!/bin/bash
echo -n "Srarting Swatch(root)"
#/usr/bin/swatch -t /var/log/messages &
#/usr/bin/swatch -t /var/log/maillog &
/usr/bin/swatch -c /etc/swatch/swatchrc -t /var/log/messages &
/usr/bin/swatch -c /etc/swatch/swatchrc -t /var/log/maillog &
/usr/bin/swatch -c /etc/swatch/swatchrc -t /var/log/vsftpd.log &
/usr/bin/swatch -c /etc/swatch/swatchrc -t /var/log/secure &
/usr/bin/swatch -c /etc/swatch/swatchrc -t /var/log/cron &
と記述してます。swatchを起動してみましたら、
[root@rh9]# /etc/rc.d/init.d/swatch.sh
swatch: error in /etc/swatch/swatchrc at line 4: option listed before
keyword. Skipping.
swatch: error in /etc/swatch/swatchrc at line 7: option listed before
keyword. Skipping.
swatch: error in /etc/swatch/swatchrc at line 10: option listed before
keyword. Skipping.
swatch: error in /etc/swatch/swatchrc at line 11: option listed before
keyword. Skipping.
swatch: error in /etc/swatch/swatchrc at line 12: option listed before
keyword. Skipping.
swatch: error in /etc/swatch/swatchrc at line 16: option listed before
keyword. Skipping.
swatch: error in /etc/swatch/swatchrc at line 17: option listed before
keyword. Skipping.
swatch: error in /etc/swatch/swatchrc at line 18: option listed before
keyword. Skipping.
swatch: error in /etc/swatch/swatchrc at line 4: option listed before
keyword. Skipping.
swatch: error in /etc/swatch/swatchrc at line 7: option listed before
keyword. Skipping.
swatch: error in /etc/swatch/swatchrc at line 10: option listed before
keyword. Skipping.
swatch: error in /etc/swatch/swatchrc at line 11: option listed before
keyword. Skipping.
swatch: error in /etc/swatch/swatchrc at line 12: option listed before
keyword. Skipping.
swatch: error in /etc/swatch/swatchrc at line 16: option listed before
keyword. Skipping.
swatch: error in /etc/swatch/swatchrc at line 17: option listed before
keyword. Skipping.
swatch: error in /etc/swatch/swatchrc at line 18: option listed before
keyword. Skipping.
swatch: error in /etc/swatch/swatchrc at line 4: option listed before
keyword. Skipping.
swatch: error in /etc/swatch/swatchrc at line 7: option listed before
keyword. Skipping.
swatch: error in /etc/swatch/swatchrc at line 10: option listed before
keyword. Skipping.
swatch: error in /etc/swatch/swatchrc at line 11: option listed before
keyword. Skipping.
swatch: error in /etc/swatch/swatchrc at line 12: option listed before
keyword. Skipping.
swatch: error in /etc/swatch/swatchrc at line 16: option listed before
keyword. Skipping.
swatch: error in /etc/swatch/swatchrc at line 17: option listed before
keyword. Skipping.
swatch: error in /etc/swatch/swatchrc at line 18: option listed before
keyword. Skipping.
swatch: error in /etc/swatch/swatchrc at line 4: option listed before
keyword. Skipping.
swatch: error in /etc/swatch/swatchrc at line 7: option listed before
keyword. Skipping.
swatch: error in /etc/swatch/swatchrc at line 10: option listed before
keyword. Skipping.
swatch: error in /etc/swatch/swatchrc at line 11: option listed before
keyword. Skipping.
swatch: error in /etc/swatch/swatchrc at line 12: option listed before
keyword. Skipping.
swatch: error in /etc/swatch/swatchrc at line 16: option listed before
keyword. Skipping.
swatch: error in /etc/swatch/swatchrc at line 17: option listed before
keyword. Skipping.
swatch: error in /etc/swatch/swatchrc at line 18: option listed before
keyword. Skipping.
Can't locate File/Tail.pm in @INC (@INC contains:
/usr/lib/perl5/5.8.0/i386-linux-thread-multi /usr/lib/perl5/5.8.0
/usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi
/usr/lib/perl5/site_perl/5.8.0 /usr/lib/perl5/site_perl
/usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi
/usr/lib/perl5/vendor_perl/5.8.0 /usr/lib/perl5/vendor_perl
/usr/lib/perl5/5.8.0/i386-linux-thread-multi /usr/lib/perl5/5.8.0 .) at
/root/.swatch_script.16051 line 430.
BEGIN failed--compilation aborted at /root/.swatch_script.16051 line 430.
swatch: error in /etc/swatch/swatchrc at line 4: option listed before
keyword. Skipping.
swatch: error in /etc/swatch/swatchrc at line 7: option listed before
keyword. Skipping.
swatch: error in /etc/swatch/swatchrc at line 10: option listed before
keyword. Skipping.
swatch: error in /etc/swatch/swatchrc at line 11: option listed before
keyword. Skipping.
swatch: error in /etc/swatch/swatchrc at line 12: option listed before
keyword. Skipping.
swatch: error in /etc/swatch/swatchrc at line 16: option listed before
keyword. Skipping.
swatch: error in /etc/swatch/swatchrc at line 17: option listed before
keyword. Skipping.
swatch: error in /etc/swatch/swatchrc at line 18: option listed before
keyword. Skipping.
Can't locate File/Tail.pm in @INC (@INC contains:
/usr/lib/perl5/5.8.0/i386-linux-thread-multi /usr/lib/perl5/5.8.0
/usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi
/usr/lib/perl5/site_perl/5.8.0 /usr/lib/perl5/site_perl
/usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi
/usr/lib/perl5/vendor_perl/5.8.0 /usr/lib/perl5/vendor_perl
/usr/lib/perl5/5.8.0/i386-linux-thread-multi /usr/lib/perl5/5.8.0 .) at
/root/.swatch_script.16048 line 430.
BEGIN failed--compilation aborted at /root/.swatch_script.16048 line 430.
というエラーが出てしまいました。
これは何が原因なのでしょうか?