In this example, we report unusual system file size changes.
The SystemFileSizeChangeUrgent script might send an alert message like the following:
-------------------------------------------------------------------------------
PIKT ALERT
Fri Oct 12 10:26:26 2001
antwerp
URGENT:
SystemFileSizeChangeUrgent
Report unusual system file size changes
the size of /etc/passwd has changed drastically, was 2321 bytes,
is now 1146 bytes
-------------------------------------------------------------------------------
SystemFileSizeChangeUrgent makes reference to the =files_system_obj macro, which resolves to the name of the FilesSystem.obj file. The script follows.
///////////////////////////////////////////////////////////////////////////////
//
// files_system_alarms.cfg
//
///////////////////////////////////////////////////////////////////////////////
[other alarms omitted...]
///////////////////////////////////////////////////////////////////////////////
SystemFileSizeChangeUrgent
init
status active
level urgent
task "Report unusual system file size changes"
input proc "=cat =files_system_obj | =awk '{print $1}'"
dat $name 1
keys $name
begin
set #pctdiff = 10% // the percentage difference beyond
// which we signal a potential problem
rule
if -e $name
set #size = #filesize($name)
else
output mail "$name not found!"
set #size = 0
next
endif
rule // bypass size check for these files
if $name =~ "/etc/mnttab|=alerts|=piktd_lok|=piktc_svc_lok"
next
endif
rule
if =deviated(size, #pctdiff)
if %size == 0
output mail "$name was non-existent or 0 bytes
(or is a new addition to the files
list), is now $text(#size) bytes"
else
if #defined(%size)
output mail "the size of $name has changed
drastically, was $text(%size)
bytes, is now
$text(#size) bytes"
endif
endif
endif
end // %size reference for new file additions next time
set #size = 0
///////////////////////////////////////////////////////////////////////////////
[other alarms omitted...]
///////////////////////////////////////////////////////////////////////////////
This is just one program example. You could add rules, or write new scripts, for example to: report system files that you don't want (such as startup files), report changes in modification times or link counts, report outdated files that should be updating regularly, report and possibly also rm core files, etc.
[For more examples, see Samples.]
Home |
FAQ |
News |
Intro |
Samples |
Tutorial |
Reference |
Software |
Authors |
Licensing |
SiteSearch
Links |
SiteIndex |
Pikt-Users |
Pikt-Workers |
Contribute |
ContactUs |
Top of Page
Page best viewed at 1024x768.
Page last updated 2005-06-22.
This site is
PIKT®
powered.
PIKT® is a registered trademark of the University of Chicago.
Copyright © 1998-2005 Robert Osterlund. All rights reserved.
|