Is the swatch I see in /opt/zimbra/libexec the "standard" swatch?
In other news, is swatch still supported at all, and finally, does anyone have a good swatch.conf for watching audit.log?
Printable View
Is the swatch I see in /opt/zimbra/libexec the "standard" swatch?
In other news, is swatch still supported at all, and finally, does anyone have a good swatch.conf for watching audit.log?
No, let me ask a different question: why are there 3 copies there: swatch, logswatch, and zmswatch, *that are all identical*?
Any special reason that might affect which one of them I would use to do my own swatching?
You might want to look at
/opt/zimbra/bin/zmauditswatchctl
/opt/zimbra/conf/auditswatchrc
auditswatch, swatch and logswatch are generally all the same version of swatch. They are named differently because they used to be killed by name on certain platforms.
Hi Brian,
any idea why zmauditswatchctl service would not start?
At first when I configured it, I found out that config file
/opt/zimbra/conf/auditswatchrc
should be named
/opt/zimbra/conf/auditswatchrc.in
But even after geting rid of all errors and warnings, I start the service as zimbra user...no error, nothing...but service status says it is not running.
Using ZCS 7.1.4