Debian Administration

Sending email on submission of some syslog-ng events

Several years ago, I implemented a centralized syslog-ng server for our Linux servers, switches, routers and firewalls. It worked very well, but I ran into situations where I would not be in front of my laptop but I wanted to be notified of something coming through.

Examples:

• Dial backups when a WAN link failed.
• File permissions on a cron file being wrong and cron failing.

There are three main parts of syslog-ng configuration: destinations, filters and logs.

Create the destination:

destination d_sendpage {
                        program (
                                 "/usr/local/bin/sendmessage.pl"
                                );
                       };

Create the filter:

filter f_sendpage {
                   message("UPDOWN: Interface Async") or
                   message("BAD FILE MODE");
                  };

Create the log:

log {
     source(s_net);
     filter(f_sendpage);
     destination (d_sendpage);
    };

Create a script to email the message that looks like this or similar:

#!/usr/bin/perl -w

use strict;

my ($fh,$file,$in);
my ($to,$from,$subject,$sendmail);

$sendmail  = "/usr/sbin/sendmail -t";
$to        = "email\@example.com";
$from      = "monitor\@example.com";
$subject   = "Alert from syslog-ng ";

$fh = \*STDIN;
while ($in = <$fh>) {
  chomp ($in);

  &sendEmail ("$in");
}

##############################################################################

sub sendEmail {
  #
  # Send an email.
  #
  my ($body);
  ($body) = @_;

  $body = $subject . $body;

  open (SENDMAIL, "|$sendmail") or die "Couldn't open sendmail: $!\n";
  print SENDMAIL "To: $to\n",
                 "From:  $from\n",
                 "Subject: $body\n",
                 "Content-type: text/plain\n\n",
                 "$body\n";
  close (SENDMAIL);
}

##############################################################################

Restart syslog-ng:

/etc/init.d/syslog-nd restart

The end result is that messages matching our defined filter-patterns will be submitted by email.

Add Comment Printable version

 

<<< Redeploying Debian-Administration.org ... Restricting SSH logins to particular IP addresses >>>