Log Monitoring using Swatch in RHEL7

The Simple WATCHer is a log monitoring tool that constantly searches log files and alerts system administrators of anything that matches the patterns described in the configuration file.

It’s an efficient way to monitor  system events like failed login attempts, installation of new packages etc

swatch, a free log-monitoring utility written 100% in Perl, monitors logs as they're being written and takes action when it finds something you've told it to look out for. Swatch does for logs what tripwire does for system-file integrity. - See more at: http://etutorials.org/Linux+systems/secure+linux-based+servers/Chapter+10.+System+Log+Management+and+Monitoring/Section+10.5.+Using+Swatch+for+Automated+Log+Monitoring/#sthash.ai9veCh9.dpuf

swatch, a free log-monitoring utility written 100% in Perl, monitors logs as they're being written and takes action when it finds something you've told it to look out for. Swatch does for logs what tripwire does for system-file integrity. - See more at: http://etutorials.org/Linux+systems/secure+linux-based+servers/Chapter+10.+System+Log+Management+and+Monitoring/Section+10.5.+Using+Swatch+for+Automated+Log+Monitoring/#sthash.ai9veCh9.dpuf

swatch, a free log-monitoring utility written 100% in Perl, monitors logs as they're being written and takes action when it finds something you've told it to look out for. Swatch does for logs what tripwire does for system-file integrity. - See more at: http://etutorials.org/Linux+systems/secure+linux-based+servers/Chapter+10.+System+Log+Management+and+Monitoring/Section+10.5.+Using+Swatch+for+Automated+Log+Monitoring/#sthash.ai9veCh9.dpuf

swatch, a free log-monitoring utility written 100% in Perl, monitors logs as they're being written and takes action when it finds something you've told it to look out for. Swatch does for logs what tripwire does for system-file integrity. - See more at: http://etutorials.org/Linux+systems/secure+linux-based+servers/Chapter+10.+System+Log+Management+and+Monitoring/Section+10.5.+Using+Swatch+for+Automated+Log+Monitoring/#sthash.ai9veCh9.dpuf

Swatch uses two required fields:

• Pattern: A regular expression to search in the log file.
• Action: The action to perform for a pattern match, like output the log entry to the console, send an email, or execute a script.

Consider the following example:

[root@server1 ~]# vi /etc/swatch/secure.conf
watchfor /ssh.*: session opened for user/ 

echo bold

mail=root@server1.mycompany.com, subject="Successful SSH Login"


[root@server1 ~]# swatch --config-file=/etc/swatch/secure.conf --tail-file=/var/log/secure --daemon

In the above example, Swatch will search the /var/log/secure log file continuously for the regular expression defined in the /etc/swatch/secure.conf config file and will output the log entry to the console on every successful SSH login and also mail the log entry to root@server1.mycompany.com.

--daemon option means that Swatch will run as a daemon (background process).


Perform the following steps:

1) Install EPEL Repository
[root@server1 ~]# yum install epel-release

2) Install packages
[root@server1 ~]# yum install swatch

3) Create config directory and configuration files
[root@server1 ~]# mkdir /etc/swatch

3.1) Monitor failed login attempts, successful root logins, failed SSH login attempts, successful SSH root login,  in the /var/log/secure log file.
[root@server1 ~]# vi /etc/swatch/secure.conf

watchfor /FAILED/
echo bold
mail=root@server1.mycompany.com, subject="Failed Login Attempt"

watchfor /ROOT LOGIN/
echo bold
mail=root@server1.mycompany.com, subject="Successful Root Login"

watchfor /ssh.*: Failed password/
echo bold
mail=root@server1.mycompany.com, subject="Failed SSH Login Attempt"

watchfor /ssh.*: session opened for user root/ 

echo bold

mail=root@server1.mycompany.com, subject="Successful SSH Root Login"

 
3.2) Monitor installation of packages in /var/log/messages log file.
[root@server1 ~]# vi /etc/swatch/messages.conf

watchfor /Installed/
echo bold
mail=root@server1.mycompany.com, subject="Installed New Package"



4) Execute Swatch
[root@server1 ~]# swatch --config-file=/etc/swatch/secure.conf --tail-file=/var/log/secure --daemon

[root@server1 ~]# swatch --config-file=/etc/swatch/messages.conf --tail-file=/var/log/messages --daemon


In this post we have manually started swatch. In the next post we will configure swatch as a custom daemon in 'systemd' by creating a custom unit file in 'systemd' and loading it into 'systemd'.