3

Out of the box, every FreeBSD machine sends two e-mails per day to the administrator (root -- usually aliased to someone):

  • Daily cron output (with status of disks, network interfaces, etc.)
  • Daily security output (with penetration-attempts found in logs, etc.)

There are also weekly and monthly report-pairs, with outputs of the jobs deemed "heavier" (like locate-updates), which do not require daily runs.

Most of the time these e-mails are tedious to the extreme and I often find myself deleting them without reading. But I feel guilty doing it -- because one day I'm liable to miss something important and because, if I'm not reading it, I may as well redirect them into /dev/унітаз to begin with.

With 5-7 FreeBSD boxes (of my own and immediate family) under my care, this is getting bothersome -- is there, perhaps, some sort of software, that can alert me to potentially "interesting" reports while quietly stashing the rest away? Something "trainable" -- like a Bayesian spam-filter?

Ideally, it would integrate with Seamonkey/Thunderbird, but can also be command-line based (I'll run it from inside ~/.procmailrc)...

  • 1
    If you're wanting to be able to go in and analyze logs of multiple servers, something like Splunk would probably work nicely; otherwise you could modify the cron jobs to only email if certain thresholds are exceeded in the reports that are now being blindly emailed. – DopeGhoti Jul 5 '17 at 15:37
  • I used Splunk - it is not trainable. You can only express rules syntactically, not semantically... :( – Mikhail T. Jul 14 '17 at 15:22
0

Regular expressions in procmail can span multiple lines (but, as with everything in procmail, you need to be careful lest a typo cause your rule to fail silently). In the past, I've written procmail recipes that match a report when everything goes well, and saves them to the noise mailbox. Then, if that report lands in my mailbox, it means that there's a problem I need to look at (either that, or that I have a problem with my .procmailrc)

Here's an example that looks at both the header and body of the message, and examines a complex report I used to receive at an old orkplace:

:0 :
* ^From: root@host.my.dom.ain
* ^To: role-account@my.dom.ain
* ^Subject: cron output from host.my.dom.ain
* B ?? ^^No account processing to do this run\.\.\.\
^Configuring databases\.  Please wait\.\.\.\
(^\*\*\* No IP address for.*)*\
^Processed [0-9]+ total hosts with the following distribution:\
(^[0-9]+        (common|osX|win(7|8)))+
\
^Generated [0-9]+ ganglia clusters containing [0-9]+ machines\
(^Installing new ssh_known_hosts\.\.\.)?\
^Looking for sendmail aliases to generate\
(^No users in passwd file that have no \(valid\) entry in aliases\.forward)?\
(^()\
^Updating the serial number in .*\.Zone )*\
(^Updating hosts file)?)+
noise

When you're writing your recipe, I recommend that you use a test message file and a test procmail file. Have the recipe save the message to a test file, then run procmail manually. Check the logging output to make sure that all of the conditions match. For the body-match part, try writing that one line at a time.

  • That's still "syntactic" rules. I'm looking for a semantic system -- something trainable, that will automatically learn, what is normal and mundane, and what stands out... – Mikhail T. Aug 7 '17 at 20:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.