Hi,

I read the article ‘Watching your log files’ and have configured SWATCH on my syslog server. However, I am not getting any emails sent to me when I purposely type in a wrong password to connect via my ssh client.

At the bottom is my swatchrc file. Could my syntax be wrong? For example, instead of ‘mail addresses’ should it be ‘mail address’ or only ‘mail’? When I check my log files it tells me there was a failed login attempt, however, no email is sent to me. Once I created the swatchrc file I ran the command:

/usr/local/bin/swatch –c /var/log/swatchrc –t /var/log/syslog &

It tells me that swatch 3.0.4 has started…..although it doesn’t immediately go back to the root prompt. Is this normal? I have to press enter to get back to a root prompt….is that normal? I see the process running by typing ‘ps’ and then ‘ps –eaf’. When I type ‘exit’ at the root prompt to exit my ssh session it tells me that it is still connected and doesn’t log me out like it normally would, therefore, I force the disconnect by clicking on the X in the top right hand corner. Then when I log back in and type ‘ps’ I no longer see the processes of swatch and perl running. But when I type ‘ps –eaf’ I see the 2 processes running.

Sorry if this is confusing, if anyone needs clarification let me know. I am running SWATCH on redhat 7.2. I noticed that swatchrc file has slightly different syntax for UNIX and LINUX. Perhaps I am spelling something wrong or am missing an = sign or something? Does syslogd have to be restarted?

I appreciate your help.

SWATCHRC

# Bad login attempts
watchfor /failed/
echo bold
mail addresses=me@mycompany.com,subject=Failed Authentication

#Sniffing Attempts
watchfor /promiscuous/
echo bold
mail addresses=me@mycompany.com,subject=Someone is sniffing syslog server

# Kernel problems or system reboots
watchfor /panic|halt/
echo bold
mail addresses=me@mycompany.com,subject=System Panic, Halt or Reboot

try using this to start swatch instead...

/usr/local/bin/swatch –c /var/log/swatchrc –t /var/log/syslog --daemon

Unfortunately that didn't work for me. Does my swatchrc file look OK (syntax and all for a linux system)?

which bit didn't work?

the --daemon option was supposed to make it go back to the root prompt

if it didn't work, try...

nohup /usr/local/bin/swatch –c /var/log/swatchrc –t /var/log/syslog &


Only the last line looks bad in your config file...

mail addresses=me@mycompany.com,subject=System Panic, Halt or Reboot


"Half or Reboot" might be seen as the next command instead of the subject.

also try replacing your line with this...

mail ADDRESSES=me@mycompany.com,SUBJECT=Failed Authentication


note: this question is probably best answered on the swatch mailing list.

I tried all of the above suggestions but to no avail. I still do not get directed to a root prompt after running the --daemon or nohup commands.

It may be that the additional perl modules which are needed are not installed properly. When I type rpm –q perl it comes back with perl 5.6.0 which is fine. However, I thought I had installed perl 5.8.0 but I must have done something wrong if it tells me that perl 5.6.0 is installed. This is not a big deal because SWATCH only requires perl 5 or greater. The reason I mention this is because I thought I also installed the additional 4 modules that SWATCH needs. But I have a hunch they to did not get installed. Can you tell me where exactly to install them (/usr/bin or /usr/bin/perl5.6.0)? Or does it matter? I installed these modules by running make, make test, make install. Is that correct? How can I verify that they are installed and the directory which they are installed in? I believe I did everything correct on the SWATCH end of things but I could be wrong. I have my swatchrc file in /var/log which should be fine I think. I also know I put a hidden swatchrc file right under root. This file is empty. Does this file also need to be the same as my swatchrc file in /var/log? Or do I need both of them? Could that be the problem?


Thanks.

if this doesn't return you back to the root prompt there's something wrong with your linux installation(not swatch)...

nohup /usr/local/bin/swatch –c /var/log/swatchrc –t /var/log/syslog &


It should tell you straight away if there're any missing perl modules, or if perl is in the wrong place, if you run it the normal way...

/usr/local/bin/swatch –c /var/log/swatchrc –t /var/log/syslog


unless you're recompiling perl you don't need to touch anything in /usr/bin

to install a perl module, it's like....

perl Makefile.PL
make install

...and it should automatically do it for you.

This may sound silly -- but what flavor of linux are you using. When I fat-finger the login on my RH box, the log entry says "authentication failure" -- if yours does to, then it wouldn't pick up on "failed", as you have in the conf file you posted.

Hope it helps.

c0d3r

Thanks for the replies from everyone. I actually have swatch working great now. It is a very cool tool.