PIKT

Samples: System File Size Changes

PIKT Logo
Home FAQ News Intro Samples Tutorial Reference Software Authors Licensing SiteSearch


In this example, we report unusual system file size changes.

The SystemFileSizeChangeUrgent script might send an alert message like the following:

-------------------------------------------------------------------------------

                                PIKT ALERT
                         Fri Oct 12 10:26:26 2001
                                 antwerp

URGENT:
    SystemFileSizeChangeUrgent
        Report unusual system file size changes

        the size of /etc/passwd has changed drastically, was 2321 bytes,
          is now 1146 bytes

-------------------------------------------------------------------------------
SystemFileSizeChangeUrgent makes reference to the =files_system_obj macro, which resolves to the name of the FilesSystem.obj file.  The script follows.

///////////////////////////////////////////////////////////////////////////////
//
// files_system_alarms.cfg
//
///////////////////////////////////////////////////////////////////////////////

[other alarms omitted...]

///////////////////////////////////////////////////////////////////////////////

SystemFileSizeChangeUrgent

        init
                status active
                level urgent
                task "Report unusual system file size changes"
                input proc "=cat =files_system_obj | =awk '{print $1}'"
                dat $name 1
                keys $name

        begin
                set #pctdiff = 10%      // the percentage difference beyond
                                        // which we signal a potential problem

        rule
                if -e $name
                        set #size = #filesize($name)
                else
                        output mail "$name not found!"
                        set #size = 0
                        next
                endif

        rule    // bypass size check for these files
                if $name =~ "/etc/mnttab|=alerts|=piktd_lok|=piktc_svc_lok"
                        next
                endif

        rule
                if =deviated(size, #pctdiff)
                        if %size == 0
                                output mail "$name was non-existent or 0 bytes
                                             (or is a new addition to the files
                                             list), is now $text(#size) bytes"
                        else
                                if #defined(%size)
                                        output mail "the size of $name has changed
                                                     drastically, was $text(%size)
                                                     bytes, is now
                                                     $text(#size) bytes"
                                endif
                        endif
                endif

        end     // %size reference for new file additions next time
                set #size = 0

///////////////////////////////////////////////////////////////////////////////

[other alarms omitted...]

///////////////////////////////////////////////////////////////////////////////
This is just one program example.  You could add rules, or write new scripts, for example to:  report system files that you don't want (such as startup files), report changes in modification times or link counts, report outdated files that should be updating regularly, report and possibly also rm core files, etc.

[For more examples, see Samples.]

Home | FAQ | News | Intro | Samples | Tutorial | Reference | Software | Authors | Licensing | SiteSearch
Links | SiteIndex | Pikt-Users | Pikt-Workers | Contribute | ContactUs | Top of Page
Page best viewed at 1024x768.   Page last updated 2005-06-22.
This site is PIKT® powered.
PIKT® is a registered trademark of the University of Chicago.
Copyright © 1998-2005 Robert Osterlund.  All rights reserved.

Computer Books at Amazon.com

Red Hat Enterprise Linux 4 For Dummies
Red Hat Enterprise Linux 4 For Dummies

UNIX CD Bookshelf
UNIX CD Bookshelf

Managing Linux Systems with Webmin
Managing Linux Systems with Webmin

CVS Pocket Reference
CVS Pocket Reference

Essential CVS
Essential CVS