22 Apr
2013
22 Apr
'13
7:15 a.m.
On 22 April 2013 14:54, Jeremy Laidman <jlaidman at rebel-it.com.au> wrote:
config files on the Xymon server. For example, something like this in client-local.cfg:
log:
if [ -f /tmp/pw.rep ]; then if grep '^[0-9]' /tmp/pw.rep | tail -n +3 | grep ^ >/dev/null; then cp /dev/null /tmp/pw.rep; fi; diff /tmp/pw.old /etc/passwd >> /tmp/pw.rep; else touch /tmp/pw.rep; fi; cp /etc/passwd /tmp/pw.old; echo /tmp/pw.rep:2048
and
Note: untested.
This is now tested, and IMHO it works well. The only problem is that the "TEXT=" modifier in analysis.cfg doesn't seem to work at all, and I just get the text "Warnings in /tmp/pw.rep" instead. But it shows the accounts added or removed, which is the important thing.
J