Can you please suggest me some solution on how to overcome this situation.<div><br></div><div>My main purpose is to invoke the script which will send an alert mail only when </div><div>there is a match of "attackalert" found in the log file.<br>
<br><div class="gmail_quote">On Tue, Nov 30, 2010 at 2:13 PM, SZALAY Attila <span dir="ltr"><<a href="mailto:sasa@balabit.hu">sasa@balabit.hu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
Hi All!<br>
<div class="im"><br>
On Tue, 2010-11-30 at 13:40 +0530, Supratik Goswami wrote:<br>
><br>
> I created "/root/workspace/test" a bash script only with a simple echo<br>
> statement to check if it is working correctly or not. The problem is<br>
> whenever I start syslog-ng the script starts executing even if the<br>
> word "attackalert" is not recorded. The following is my syslog-ng.conf<br>
> configuration. Is there anything I am missing here ? Please advice.<br>
<br>
</div>Yes, this is the expected (and documented) behavior. Syslog-ng start the<br>
scipt at the start time and the script should wait for the messages.<br>
<br>
And the script should not exit either because syslog-ng would not like<br>
it.<br>
<br>
--<br>
SZALAY Attila<br>
Support (L3) Team Leader<br>
<br>
e-mail: <a href="mailto:attila.szalay@balabit.com">attila.szalay@balabit.com</a><br>
<br>
BalaBit IT Security<br>
<a href="http://www.balabit.com" target="_blank">www.balabit.com</a><br>
H-1115 Bártfai str. 54. Budapest<br>
<br>
This Communication is Confidential. We only send and receive email on<br>
the basis of the terms set out at <a href="http://www.balabit.com/disclaimer/" target="_blank">http://www.balabit.com/disclaimer/</a>.<br>
<br>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.campin.net/syslog-ng/faq.html" target="_blank">http://www.campin.net/syslog-ng/faq.html</a><br>
<br>
</blockquote></div><br><br clear="all"><br>-- <br>Warm Regards<br><br>Supratik<br>
</div>