Changeset 581

Timestamp:

Sep 8, 2024, 1:10:09 PM (3 months ago)

Author:

katerina

Message:

Fix for ticket #469 (regression in log monitoring code).

Location:

trunk

Files:

• configure.ac (modified) (1 diff)
• docs/Changelog (modified) (1 diff)
• src/sh_log_check.c (modified) (1 diff)
• test/testrc_1 (modified) (1 diff)

trunk/configure.ac

@@ -12 +12 @@
 dnl start
 dnl
-AM_INIT_AUTOMAKE(samhain, 4.5.0)
+AM_INIT_AUTOMAKE(samhain, 4.5.1)
 AC_DEFINE([SAMHAIN], 1, [Application is samhain])
 AC_CANONICAL_HOST

trunk/docs/Changelog

@@ +1 @@
+4.5.1  (08-09-2024):
+        * fix for regression in SHELL option for log file monitoring
+          (issue reported by ssha)
+
 4.5.0  (31-10-2023):
         * fix for reading file attributes on Linux file systems

trunk/src/sh_log_check.c

@@ -852 +852 @@
   entry = SH_ALLOC(sizeof(struct task_entry));
 
-  status = sh_ext_popen_init (&(entry->task), logfile->filename, logfile->filename, NULL);
+  status = sh_ext_popen_init (&(entry->task), logfile->filename, NULL, NULL);
   if (0 == status)
     {

trunk/test/testrc_1

@@ -89 +89 @@
 # dir=1/home/rainer
 
-#[SuidCheck]
-#SuidCheckActive=T
+[SuidCheck]
+SuidCheckActive=false
 #SuidCheckExclude=/home
+
+[ProcessCheck]
+#
+# Activate (default is on)
+#
+ProcessCheckActive = no
+          
+[PortCheck]
+#
+# Activate (default is on)
+#
+PortCheckActive = no
+
+
+[Logmon]
+          
+#
+# Switch on the module
+#
+LogmonActive = yes
+
+# Check every second
+#
+LogmonInterval = 1
+
+# Strip PIDs from syslog messages
+#
+Logmonhidepid = true
+
+# Define a queue with severity 'crit'.
+# This is a 'report' queue, hence 'interval' (10)
+# will be ignored.
+#
+LogmonQueue = q1:10:report:crit
+
+# Monitor disks to check for full /dev/sda1
+#
+LogmonWatch = SHELL:df -h
+
+# Warn about disk /dev/sda1 nearly full (80% or more. Use a 
+# non-capturing subexpression [the (?:8|9)] for the percentage full.
+#
+LogmonRule = q1:/dev/nvme1n1p4\s+[0-9GM.]+\s+[0-9GM.]+\s+[0-9GM.]+\s+(?:8|9).%.*
+
+LogmonDeadtime = 120
+LogmonRule = trash:.*
+
 
 [EventSeverity]