[Bug 169345] Review Request: SEC - Simple Event Correlator

[bugzilla at redhat.com]

Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug report.

Summary: Review Request: SEC - Simple Event Correlator


https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=169345


lists at forevermore.net changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |lists at forevermore.net




------- Additional Comments From lists at forevermore.net  2006-06-12 18:44 EST -------
I was going to package up SEC for inclusion in extras, but noticed that this had
already been started.  Since Didier has been having some trouble with basic spec
layout, I offered to built a better spec for him to maintain.

In order to fit better with redhat/fedora schemes, I've rewritten major portions
of Didier's stuff, including the sysV init script and /etc/sysconfig/sec file
(to support multiple instances), added more example files and reorganized the
/etc/sec directory to make it more usable by a larger variety of people.

Didier, your current spec assumes that people will be running solely against
/var/log/messages and does not make it particularly easy to monitor other files
(at the same time or otherwise).  After a fair amount of thinking about this, I
realized that the first thing the majority of people using SEC would do would be
to tear out your default files.  In this new version, everything is disabled by
default and examples are placed in /etc/sec/examples along with /etc/sec/README
and more documentation in /etc/sysconfig/etc to tell users what to do to set up
SEC to fit their needs.

I've also added a logrotate script and a few extra provides/requires
(documented/commented in the spec).

SPEC:  http://rpm.forevermore.net/sec/sec.spec
SRPM:  http://rpm.forevermore.net/sec/sec-2.3.3-3.src.rpm

I have yet to actually *use* SEC, so Didier is still probably the best one to
maintain this, but I am happy to hang around for advice/etc.

-- 
Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the QA contact for the bug, or are watching the QA contact.