Hi<br><br>I think SEC can do what you're looking for.<br><br>Simple Events Correlator is a powerful perl script which can detect special logs.<br><br>Just have a look at :<a href="http://www.estpak.ee/~risto/sec/">http://www.estpak.ee/~risto/sec/
</a><br><br>after that, you'l have to write your own rules which is pretty simple<br><br>bye<br><br><div><span class="gmail_quote">2007/8/3, Darwin, Samuel <<a href="mailto:darwins@thirteen.org">darwins@thirteen.org
</a>>:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">Hi,<br><br>Is there a good way to have syslog-ng email me when particular log
<br>events occur?<br><br>I am running a very standard, default installation of CentOS 5.<br><br>Example:<br><br>I tried this sort of methodology, but it didn't work:<br><br>source net { udp(); };<br>destination emailer { program("mail
<a href="mailto:myaddress@yahoo.com">myaddress@yahoo.com</a>"); };<br>log { source(net); destination(emailer); };<br><br>In this case, I'd expect to be emailed a copy of every single message<br>received over udp. However, what happens is that the program "mail
<br><a href="mailto:myaddress@yahoo.com">myaddress@yahoo.com</a>" gets run and appears in the process table, but no<br>emails are sent. The syslog log file shows dropped='program(mail<br><a href="mailto:myaddress@yahoo.com">
myaddress@yahoo.com</a>)=0' , indicating something is being "dropped".<br><br>I think that I must be going about this the wrong way. Maybe I can't<br>use syslog-ng to send emails?<br><br><br>Thanks,<br>
Sam Darwin<br><a href="http://Thirteen.org">Thirteen.org</a><br><br>_______________________________________________<br>syslog-ng maillist - <a href="mailto:syslog-ng@lists.balabit.hu">syslog-ng@lists.balabit.hu</a><br><a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">
https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>Frequently asked questions at <a href="http://www.campin.net/syslog-ng/faq.html">http://www.campin.net/syslog-ng/faq.html</a><br><br></blockquote></div><br>