[ale] Monitoring dhcpd.leases file?

[Scott Bragg]

I'd approach it by experimenting with inotifywait  and piping the diff of
the pre-change with post-change file.    I'm not at a system that I can
experiment with, but that's my first blush idea of which direction to go.

OSSEC uses inotify, epoll and such for it's realtime monitoring and
reactive monitoring.   You could easily set up a trigger in OSSEC to do
what you want, but that'd be *extreme* overkill.

Scott Bragg


On Mon, Jan 5, 2015 at 5:10 PM, Alex Carver <agcarver+ale at acarver.net>
wrote:

> Could you set up a cron job every minute that MD/SHA hashes the file,
> compares with the hash from a previous iteration, and if the hashes
> don't match, diff the new with the old and process the diff result?
> (Obviously if a difference in the hashes is found you save state to use
> for the next round of comparisons.)
>
> On 2015-01-05 11:49, James Sumners wrote:
> > For those interested, parsing the data in realtime, at least with
> Node.js,
> > is not viable. So this question is irrelevant.
> >
> > On Thu, Dec 18, 2014 at 12:59 PM, James Sumners <james.sumners at gmail.com
> >
> > wrote:
> >
> >> I need to monitor ISC's dhcpd.leases file so that I can feed new leases
> >> into a processor (which will log them to a database). My processor
> listens
> >> for data on a Unix socket . So I'll want to feed the data being
> appended to
> >> dhcpd.leases into that socket. But I also need it to still write to the
> >> leases file.
> >>
> >> Does anyone have any suggestions on how I might go about doing this?
> It's
> >> going to need to run non-stop.
> >>
> >> --
> >> James Sumners
> >> http://james.roomfullofmirrors.com/
> >>
> >> "All governments suffer a recurring problem: Power attracts pathological
> >> personalities. It is not that power corrupts but that it is magnetic to
> the
> >> corruptible. Such people have a tendency to become drunk on violence, a
> >> condition to which they are quickly addicted."
> >>
> >> Missionaria Protectiva, Text QIV (decto)
> >> CH:D 59
> >>
> >
> >
> >
> >
> >
> > _______________________________________________
> > Ale mailing list
> > Ale at ale.org
> > http://mail.ale.org/mailman/listinfo/ale
> > See JOBS, ANNOUNCE and SCHOOLS lists at
> > http://mail.ale.org/mailman/listinfo
> >
>
> _______________________________________________
> Ale mailing list
> Ale at ale.org
> http://mail.ale.org/mailman/listinfo/ale
> See JOBS, ANNOUNCE and SCHOOLS lists at
> http://mail.ale.org/mailman/listinfo
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.ale.org/pipermail/ale/attachments/20150105/fcc34e67/attachment.html>