Introduction

Creating your own rules is easy, lets say we want to create a rule that prints the name of the monitor to sentinela’s log file when the /var/log/apache2/access.log logfile is inactive during 10 minutes’. The code will look like this:

1: from modules.monitors.new_log_entries import NewLogEntries
2: from modules.actions.debug_print import DebugPrint
3:
4: apache_log = NewLogEntries('/var/log/apache2/access.log', 10)
5: debug_print = DebugPrint()
6:
7:
8: def call_every_minute():
9:     if apache_log.call_every_minute():
10:        debug_print.do(apache_log)

Source Code Analysis

Common rules will have a monitor and an action, in this case they NewLogEntries and DebugPrint (lines 1 and 2).

Both of them need to be instanciated at the module level (lines 4 and 5) in order to be able to keep state. If you create your monitor or action instances inside the call_every_minute a new instance is going to be created each time and no state will be kept.

Monitors and actions can have parameters, in this line 4 we see how the NewLogEntries monitor takes two parameters:

• The log file to monitor for changes

• How many minutes of inactivity it will wait until returning True

The call_every_minute function (line 8) needs to be defined for a rule to be valid. This function, as the name indicates, will be called every minute by sentinela. You could define any actions to be run in this context, but we decide to call the monitor’s call_every_minute method and based on it’s return value call the action with the apache_log instance as parameter.

apache_log.call_every_minute() will return True only if the file passed as parameter doesn’t have any new entries in 10 minutes.

debug_print.do will print the name of the monitor passed as parameter.

Enabling new rules

Once you’ve created your own rule, you’ll have to follow these steps to run them:

• Copy your .py file to the rules/ directory in the sentinela installation

• Update the config/sentinela.cfg to include your rule name (without the extension)

• Restart the sentinela daemon

Example rules

Example rules can be found in the sentinela/rules directory in this repository.

Testing new rules

In order to test your new rules before deploying them you can follow these steps.