SWATCH(5)

NAME
swatchrc - configuration file for the simple watcher swatch(8)

SYNOPSIS
~/.swatchrc

DESCRIPTION
This configuration file is used by the swatch(8) program to determine what types of expression patterns to look for and what type of action(s) should be taken when a pattern is matched.

The file contains four TAB separated fields:

    /pattern/[,/pattern/,...]    action[,action,...]    [[HH:]MM:]SS    start:length

A pattern must be a regular expression which perl(1) will accept, which is very similar to the regular expressions which egrep(1) accepts.

The following actions are acceptable:

echo[=mode]
    Echo the matched line. The text mode may be normal, bold, underscore, blink, inverse. Some modes may not work on some terminals. Normal is the default.

bell[=N]
    Echo the matched line, and send a bell N times (default = 1).

exec=command
    Execute command. The command may contain variables which are substituted with fields from the matched line. A $N will be replaced by the Nth field in the line. A $0 or $* will be replaced by the entire line.

ignore
    Ignore the matched line.

mail[=address:address:...]
    Send mail to address(es) containing the matched lines as they appear (default address is the user who is running the program).

pipe=command
    Pipe matched lines into command.

write[=user:user:...]
    Use write(1) to send matched lines to user(s).

The third field (which is optional) can contain a time interval. The time should be in one of three formats:

SS  -- Just seconds

MM:SS
    -- Minutes and seconds

HH:MM:SS
    -- Hours minutes and seconds

If an interval is specified and more than one identical line is received, swatch will not do the actions specified until the specified time has elapsed. If the action that is performed uses the input line then the number of lines will be included in the line.

The fourth field is also optional and must only exist if the the third field exists. This field is used to specify the location of the time stamp in the log message as well as the length of the time stamp. It should be specified in the form start:length.

EXAMPLE

    /file system full/ echo,bell 01:00 0:16

This example a line which contains the string "file system full" will be echoed and the screen bell will sound. Also, multiple instances of the message will not be echoed if they appear within a minute of the first one. Instead the following message will be acted upon after the time interval has expired. This is what may appear if a the message appeared 20 times.

    ** 20 seen in 00:01:00 ==> somehost: /var: file system full

SEE ALSO
swatch(8), perl(1), egrep(1),

AUTHOR
E. Todd Atkins (Todd.Atkins@CAST.Stanford.EDU)
Computer Administration Support Team
Distributed Computing Group
Stanford University