linux安装swatch的教程,linux swatch 使用笔记

一. 准备

1. 下载和解压缩最新的Swatch软件包.建议从Swatch的官方网站获得可靠的Swatch软件包.

下载网址:

1) 创建Swatch软件包存放的目录.

mkdir -p /usr/local/src/log

2) 解压缩源代码包

tar zpxf swatch-***.tar.gz

二. 安装

cd swatch-***

perl Makefile.PL

可能出现：

Checking if your kit is complete...

Looks good

Warning: prerequisite Date::Calc 0 not found.

Warning: prerequisite Date::Format 0 not found.

Warning: prerequisite File::Tail 0 not found.

Warning: prerequisite Time::HiRes 1.12 not found.

解决方法1：

perl -MCPAN -e shell

>install Date::Calc

然后就一直点Yes,依次安装剩下的三个。

解决方法2：

直接用wget下载下列文件然后，$ tar zxvf $SOURCE/Date-calc-5.3.tar.gz

$ cd $SOURCE/Date-Calc-5.2

$ perl Makefile.PL

$ make

$ make test

$ su

# make install

make

make test

make install

make realclean

Swatch程序安装成功后, Perl模块将会用于Swatch程序的运行.

三 使用

1、使用之前，需要创建一个.conf文件

例如:创建一个/root/abc.conf文件，内容为：

watchfor /[Ff]ail/

echo red

bell 1

exec "echo 000000"

2、简单使用

swatch --config-file=/root/abc.conf

--examine=/var/log/secure.1

得到结果：

*** swatch version 3.2.3 (pid:11950) started at 三 9月 17 09:06:06 CST 2008

Sep 4 22:33:18 localhost sshd[16376]: Failed password for root from 172.17.199.15 port 2883 ssh2

000000

3、其他

3.1一个conf脚本示例

I. More detailed swatch.conf example script

# Swatch configuration file for constant monitoring

ignore /news/

# Server problems -- we consider this to be relatively low-priority, so we just get email.

watchfor /restart|panic|halt/

bell

mail=admin@foo.bar,subject=Log_Data_Server_Info

# SSH stuff -- also low-priority, but we still want to know when users are ssh'd in.

watchfor /SSH|sshd2/

mail=admin@foo.bar,subject=Log_Data_SSH

# We want to know if someone tries to SU root -- does everything (emails multiple people,

# emails cell phone, pages Admin with pager code 911)

watchfor /root/

bell

mail=admin@foo.bar:other_admin@bar.foo:5551212@cell_messaging.com,subject=Log_Data_ROOT

throttle 0:2:0,use=regex # so it doesn't confuse the modem and interrupt paging

exec chat -f /etc/chatscript.txt -v -s -T 911 < /dev/modem > /dev/modem

# router problems - does everything (emails multiple people, emails cell phone, pages Admin

# with pager code 444)

watchfor /router/

bell

mail=admin@foo.bar:other_admin@bar.foo:5551212@cell_messaging.com,subject=Log_Data_Router

throttle 0:2:0,use=regex

exec chat -f /etc/chatscript.txt -v -s -T 444 < /dev/modem > /dev/modem

# If adduser is run, could be critical -- does everything (emails multiple people, emails cell

# phone, pages Admin with pager code 666)

watchfor /addgrp|adduser/

bell

mail=admin@foo.bar:other_admin@bar.foo:5551212@cell_messaging.com,subject=Log_Data_Adduser

throttle 0:2:0,use=regex

exec chat -f /etc/chatscript.txt -v -s -T 666 < /dev/modem > /dev/modem

# Bad login attempts -- mails us and pages Admin with pager code 888

watchfor /authentication failure/

bell

mail=admin@foo.bar:other_admin@bar.foo:5551212@cell_messaging.com,subject=Log_Data_Bad_Login

throttle 0:2:0,use=regex

exec chat -f /etc/chatscript.txt -v -s -T 888 < /dev/modem > /dev/modem

# end of swatch.conf

3.2 Swatch可以设置成开机后自动后台运行，只需要在rc.local加入一行：

/usr/bin/swatch -c /etc/swatch.conf - t /var/log/messages &

3.3如果希望Swatch监控多个日志文件,需要多次执行Swatch,如果每类文件的设置不同，相应的conf文件也不同。

3.3.1使用Swatch来自东禁止非法连接。(下面是参考，还没研究过)

http://cubic9.com/Linux/Swatch/

%C9%D4%C0%B5%A5%A2%A5%AF%A5%BB%A5%B9%B4%C6%BB%EB

%2Fswatch

3.4 Swatch时时监视新增加的内容，使用 -t The -t flag tells Swatch which file it should tail (monitor).

3.5 另一个conf例子：Some important Swatch switches, listed alphabetically. See the sample config files for specific usage examples:

bell

Make the console beep. You can change the number of beeps; default is 1.

continue

If multiple watchfor sections contain a pattern which could occur in

the same single log entry, then "continue" will tell Swatch to continue

comparing its key patterns to the log entry even after it finds the

first match. Take for example a watchfor section that contains both

/root/ and /login/, and the log line "root: login successful" is

generated. Swatch would normally just execute actions when it saw the

first match -- "root" -- and then stop parsing that line of the log,

thus effectively ignoring the occurrence of "login" in this case.

"Continue" prevents this.

echo

Dump flagged log entries to the console.

exec

Execute whatever shell command follows. See section on chat for examples.

ignore

We can tell Swatch to ignore the things we don't care about. The syntax

for this is ignore /whatever/ where "whatever" is the pattern in

question. The command and the pattern should be separated by spaces or

tabs. Separate each item with the pipe character |.

mail

Send email message to any number of addresses, separated by colons. For

our convenience, we can make the subject line reflect the items flagged

(see sample config file for syntax). The email message body will, by

default, contain the full line of the log entry that triggered Swatch.

throttle

The throttle command keeps the action (whatever follows on the next

line) from being executed too many times at once, which might happen if

the event in question generates multiple lines in the log, which each

contain the string we're watching for. So, we use throttle to suppress

subsequent reportings of the same event for a specified period of time

after the first instance of the event. The format is throttle HH:MM:SS

(hours, minutes, and seconds) and the use=regex option tells Swatch to

use the pattern specified in the watchfor line, as opposed to using the

message body itself, which is the default. For example, the log

messages: "sshd2[PID]: Local disconnected: Connection closed." and

"sshd2[PID]: connection lost: 'Connection closed.'" use slightly

different wording, so the default throttle settings would not work

here. But if we include use=regex, then sshd2 is the determining

string, and thus throttle will work correctly.

watchfor

This is what we use to specify which log entries to watch for, and

subsequently what to do in the instance of such an entry. Separate each

item with the pipe character |.

A sample Swatch configuration file:

Expect to go back and tweak the config file a few times when you first

begin using Swatch. You'll find that some patterns you specify in the

watchfor sections will appear elsewhere in subtle ways, resulting in

unintended flagging by Swatch. For example, if you specify "watchfor

/su/" intending to flag the su command (someone trying to switch to

another user) then Swatch will flag that, but will also trigger on any

log line that contains the word "succeeded" (which appears in the event

of a successful, legitimate login!) Try using "watchfor /root/"

instead. Remember that you can test to see if Swatch is listening and

behaving properly by using the "logger x" command.

# Sample Swatch configuration file for constant monitoring.

ignore /news/

watchfor /restart|panic|halt/

bell

mail=admin@foo.bar:other_admin@bar.foo,subject=Log_Data_Crash

watchfor /SSH|sshd2/ # watch for both the session and the daemon

echo

bell

throttle 0:2:0,use=regex # in case of multiple attempts in rapid succession;

# ssh also generates multiple log lines even for a

# single successful login

mail=admin@foo.bar,subject=Log_Data_SSH

watchfor /blah|blah/ etc...

# End of script (a more detailed sample config file is included at the end of this document)

You can separate different events and have Swatch perform different

alerting routines, based on severity, type, etc.. For example, server

problems like reboots, kernel panics, etc. could be set up to result in

an email with subject line "LogData-Server" while suspicious login

attempts could have subject line "LogData-AuthFail," etc. See the

complete configuration example at the end of this document for more

examples. Breaking things down like this makes it easier for you to

sort the emails generated by Swatch, and you can tell from one glance

at your inbox what kinds of things have been happening on your network.

A good idea is to have redundant alert methods available to Swatch,

especially for the more critical events. For example, specify multiple

email addresses (preferably belonging to multiple people who can find

you) in the more important watchfor sections.

3.6另一个conf例子

Swatch Rules

The main configuration file is /etc/swatch/swatch.conf. Here is a good example:

File: /etc/swatch/swatch.conf

# Global swatch filter file

# To ignore a IP-range

ignore /216\.239\.37\./

# Invalid SSH Login Attempts

watchfor /(: [iI]nvalid [uU]ser )(.*)( from )(.*)$/

throttle threshold=3,delay=0:1:0,key=$4

mail addresses=admin\@domain.com,subject="SSH:\ Invalid\ User\ Access-IPTables\ Rule\ Added"

exec "/sbin/iptables -A swatch_rejects -s $4 -j DROP"

# Failed SSH Login Attempts

watchfor /(: [fF]ailed password for )(.*)( from )(.*)( port )(.*)$/

throttle threshold=3,delay=0:1:0,key=$4

mail addresses=admin\@domain.com,subject="SSH:\ Invalid\ User\ Access-IPTables\ Rule\ Added"

exec "/sbin/iptables -A swatch_rejects -s $4 -j DROP"

# Invalid SSH Login Attempts. Another one - just formed differently

watchfor /([aA]uthentication [fF]ailure for [iI]llegal [uU]ser )(.*)( from )(.*)$/

throttle threshold=3,delay=0:1:0,key=$4

mail addresses=admin\@domain.com,subject="SSH:\ Invalid\ User\ Access-IPTables\ Rule\ Added"

exec "/sbin/iptables -A swatch_rejects -s $4 -j DROP"

A little explanation of whats being done:

ignore /216\.239\.37\./

This is to ignore, in this case, a IP-range. Very usefull to minimize the possibility that you lock yourself out.

watchfor /(: [iI]nvalid [uU]ser )(.*)( from )(.*)$/ watchfor /(:

[fF]ailed password for )(.*)( from )(.*)( port )(.*)$/ watchfor

/([aA]uthentication [fF]ailure for [iI]llegal [uU]ser )(.*)( from

)(.*)$/

This is to search our logs for the string between //. The parens in

the first watchfor are important - they break up the log file line into

chucks that are used for $1,$2,$3, ... $n. In this case, for example,

$1 is ": Invalid User "; $2 is all the junk in the first (.*); $3 is "

from "; and $4 is all the junk in the second (.*) -- which happens to

be the IP address you want. Note: the $ at the end signifies end of

line. Also, note that the $4 works in both the first and third watchfor

code block -- this is pure coincidence and you may need to change the

$4 to a different paren set if you are working with your own custom

watchfor block.

throttle threshold=3,delay=0:1:0,key=$4

The "key" tell swatch how to identify the log line. We

can't use the whole string here, because the same attacker (ie the same

IP) will probably try multiple user names. The key can refer to one of

the parens set in the search string (here, $4 = the IP).

The "threshold" is the number of times swatch need to see the "key" to execute the actions below.

The "delay" is the validity of each "key". When older that 'delay', the "key" is discarded. Use a syntax like HH:MM:SS.

Note: If this does work in 3.1.1, it may not work with loggers such

as metalog, because it says instead "Last output repeated N times" So

naturally swatch won't find multiple occurances often in those cases.

mail addresses=admin\@domain.com,subject="SSH:\ Invalid\ User\ Access-IPTables\ Rule\ Added"

Mail a user stating that a new rule has been added to iptables.

exec "/sbin/iptables -A swatch_rejects -s $4 -j DROP"

Add the offending ip to "swatch_rejects" and drop all future

incoming packets from that address. If you are using shorewall, you can

define in this way:

exec "/sbin/shorewall drop $4"

3.7

Another way to control swatch to a greater degree is to specify what

time of day a given action may be performed. You can do this by

sticking a “when=” option after any action. For example, below I've got

a .swatchrc entry for a medium-importance event I want to know about

via console messages during weekdays, but I'll need e-mail messages to

know about it during the weekend. To do this I set the when option:

/file system full/ echo=red mail addresses=mick\@visi.com, subject=Volume_Full,when=7-1:1-24

The syntax of the when= option is when=range_of_days:range_of_hours.

Thus, we see that any time the message “file system full” is logged,

swatch will echo the log entry to the console in red ink. It will also

send e-mail, but only if it's Saturday (“7”) or Sunday (“1”).