The end result is that each host logs its traffic to its own log directory, as well as to the logging server. A more detailed explanation of the syslog setup, along with examples, is included at the end of this document. Check the man pages for further details on syslog and syslogd. A typical NTP setup includes configuring a master server to syn with two off-site NTP servers, then other local hosts feed off of that. Swatch Swatch is a program which can actively monitor log messages as they are written to file via the UNIX syslog utility.
Swatch consists of a configuration file, a library of actions, and the controlling program.
This capability makes Swatch an attractive tool for 24-hour security monitoring. Installation from source requires several Perl libraries you may not have. Swatch can be configured to execute and run in the background at startup. That config file is where the administrator defines patterns to flag and what to do in each case. Swatch's syntax is easy to use, yet provides a great deal of flexibility with regard to the kinds of actions that can be taken.