Changeset 581


Ignore:
Timestamp:
Sep 8, 2024, 1:10:09 PM (2 months ago)
Author:
katerina
Message:

Fix for ticket #469 (regression in log monitoring code).

Location:
trunk
Files:
4 edited

Legend:

Unmodified
Added
Removed
  • trunk/configure.ac

    r580 r581  
    1212dnl start
    1313dnl
    14 AM_INIT_AUTOMAKE(samhain, 4.5.0)
     14AM_INIT_AUTOMAKE(samhain, 4.5.1)
    1515AC_DEFINE([SAMHAIN], 1, [Application is samhain])
    1616AC_CANONICAL_HOST
  • trunk/docs/Changelog

    r580 r581  
     14.5.1  (08-09-2024):
     2        * fix for regression in SHELL option for log file monitoring
     3          (issue reported by ssha)
     4
    154.5.0  (31-10-2023):
    26        * fix for reading file attributes on Linux file systems
  • trunk/src/sh_log_check.c

    r541 r581  
    852852  entry = SH_ALLOC(sizeof(struct task_entry));
    853853
    854   status = sh_ext_popen_init (&(entry->task), logfile->filename, logfile->filename, NULL);
     854  status = sh_ext_popen_init (&(entry->task), logfile->filename, NULL, NULL);
    855855  if (0 == status)
    856856    {
  • trunk/test/testrc_1

    r19 r581  
    8989# dir=1/home/rainer
    9090
    91 #[SuidCheck]
    92 #SuidCheckActive=T
     91[SuidCheck]
     92SuidCheckActive=false
    9393#SuidCheckExclude=/home
     94
     95[ProcessCheck]
     96#
     97# Activate (default is on)
     98#
     99ProcessCheckActive = no
     100         
     101[PortCheck]
     102#
     103# Activate (default is on)
     104#
     105PortCheckActive = no
     106
     107
     108[Logmon]
     109         
     110#
     111# Switch on the module
     112#
     113LogmonActive = yes
     114
     115# Check every second
     116#
     117LogmonInterval = 1
     118
     119# Strip PIDs from syslog messages
     120#
     121Logmonhidepid = true
     122
     123# Define a queue with severity 'crit'.
     124# This is a 'report' queue, hence 'interval' (10)
     125# will be ignored.
     126#
     127LogmonQueue = q1:10:report:crit
     128
     129# Monitor disks to check for full /dev/sda1
     130#
     131LogmonWatch = SHELL:df -h
     132
     133# Warn about disk /dev/sda1 nearly full (80% or more. Use a
     134# non-capturing subexpression [the (?:8|9)] for the percentage full.
     135#
     136LogmonRule = q1:/dev/nvme1n1p4\s+[0-9GM.]+\s+[0-9GM.]+\s+[0-9GM.]+\s+(?:8|9).%.*
     137
     138LogmonDeadtime = 120
     139LogmonRule = trash:.*
     140
    94141
    95142[EventSeverity]
Note: See TracChangeset for help on using the changeset viewer.