EPEL repository added
# rpm -ivh https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
swatch installation
# yum install swatch --enablerepo=epel
When the string "action =" auth-logon "" is detected in the log file
--Display on screen --Email notification
# vi swatch_fwlog.conf
watchfor /action=\"auth-logon\"/
echo
[email protected],subject="[sslvpn] logon success"
# /usr/bin/perl /bin/swatch -c /root/swatch_fwlog.conf -t /var/log/fwlog &
#kill process number
# vi /lib/systemd/system/swatch_fwlog.service
[Unit]
Description=swatch for firewall log
After=syslog.target network.target postfix.service
[Service]
ExecStart=/usr/bin/swatch -c /root/swatch_fwlog.conf -t /var/log/fwlog --pid-file /var/run/swatch_fwlog.pid --daemon > /dev/null 2>&1
Type=forking
PIDFile=/var/run/swatch_fwlog.pid
[Install]
WantedBy=multi-user.target
# systemctl daemon-reload
# systemctl enable swatch_fwlog
# systemctl start swatch_fwlog
# systemctl status swatch_fwlog
# systemctl stop swatch_fwlog
--It is necessary to create a configuration file for each log file and execute swatch individually. --The corresponding line of the log is inserted in the body of the email notification