{"id":43523202,"url":"https://github.com/fxnn/gowatch","last_synced_at":"2026-02-03T14:35:49.701Z","repository":{"id":29098317,"uuid":"32627609","full_name":"fxnn/gowatch","owner":"fxnn","description":"Configurable logfile analysis for your server.","archived":false,"fork":false,"pushed_at":"2015-06-27T22:51:25.000Z","size":474,"stargazers_count":8,"open_issues_count":9,"forks_count":2,"subscribers_count":3,"default_branch":"master","last_synced_at":"2024-06-19T10:05:53.883Z","etag":null,"topics":["go","golang","grok","logfile","logs","logwatch","sysadmin"],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/fxnn.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2015-03-21T10:02:53.000Z","updated_at":"2024-06-19T10:05:53.884Z","dependencies_parsed_at":"2022-09-26T18:01:49.895Z","dependency_job_id":null,"html_url":"https://github.com/fxnn/gowatch","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/fxnn/gowatch","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fxnn%2Fgowatch","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fxnn%2Fgowatch/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fxnn%2Fgowatch/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fxnn%2Fgowatch/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/fxnn","download_url":"https://codeload.github.com/fxnn/gowatch/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fxnn%2Fgowatch/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29047566,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-03T10:09:22.136Z","status":"ssl_error","status_checked_at":"2026-02-03T10:09:16.814Z","response_time":96,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["go","golang","grok","logfile","logs","logwatch","sysadmin"],"created_at":"2026-02-03T14:35:49.573Z","updated_at":"2026-02-03T14:35:49.677Z","avatar_url":"https://github.com/fxnn.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# gowatch\n\ngowatch provides configurable logfile analysis for your server. It is able to parse your logfiles and create summaries in formats ready for delivery via E-Mail or Web.\n\n[![Build Status](https://travis-ci.org/fxnn/gowatch.svg)](https://travis-ci.org/fxnn/gowatch)\n[![Go Report Card](http://goreportcard.com/badge/fxnn/gowatch)](http:/goreportcard.com/report/fxnn/gowatch)\n\n## Installation\n\nJust `go get` the program.\nThe following assumes that your `GOPATH` is set and your `PATH` contains your `$GOPATH/bin` directory;\nif not so, please read the [Code Organization](https://golang.org/doc/code.html#Organization) chapter of the go manual.\n\n```\n$ go get github.com/fxnn/gowatch\n$ gowatch\n2015/04/08 19:10:44 No configuration file given. Specify one using `-c /path/to/config.yml`\n```\n\n## Usage\n\n`gowatch` will always run with a configuration file, pass it with the `-c` option:\n\n```\ngowatch -c /path/to/config.yml\n```\n\nRelative paths will always be resolved based on your current working directory. Note, that this also holds for paths inside the configuration file.\n\nThe configuration files itself are separated into three main sections: logfiles, mappers *(not implemented yet)* and summarizers. This reflects the architecture (see below).\n\nAn example configuration file would be\n\n```yaml\nlogfiles:\n- filename: /var/log/auth.log\n  tags: ['auth.log']\n  with: {pattern: '%{SYSLOGBASE} %{GREEDYDATA:Message}'}\n  where: {\n    timestamp: {\"younger than\": \"24h\"}\n  }\n- filename: /var/log/mail.log\n  tags: ['mail.log']\n  with: {pattern: '%{SYSLOGBASE} %{GREEDYDATA:Message}'}\n  where: {\n    timestamp: {\"younger than\": \"24h\"}\n  }\n\nsummary:\n- do: count\n  title: Sudoers\n  where: {tags: {contains: 'auth.log'}}\n  with: {\n    '%{user}-\u003e%{effective_user}: %{command}': '\\s*%{USER:user}\\s*: TTY=%{DATA} ; PWD=%{PATH} ; USER=%{USER:effective_user} ; COMMAND=%{PATH:command}(: %{GREEDYDATA:arguments})?'\n  }\n- do: count\n  title: Stored Mails\n  where: {tags: {contains: 'mail.log'}}\n  with: {\n    'Stored [%{mailboxname}]': \"deliver\\\\(%{USER:user}\\\\): sieve: msgid=\u003c%{DATA}\u003e: stored mail into mailbox '%{DATA:mailboxname}'\",\n  }\n```\n\nThe configuration above would give the following output:\n\n```\nSudoers\n=======\njon.doe-\u003eroot: /bin/chown: 1\njon.doe-\u003eroot: /bin/ln: 1\njon.doe-\u003eroot: /bin/ls: 1\njon.doe-\u003eroot: /bin/mv: 1\njon.doe-\u003eroot: /home/jon.doe/workspace/go/bin/gowatch: 9\njon.doe-\u003eroot: /usr/bin/less: 7\njon.doe-\u003eroot: /usr/bin/vim: 9\n\nStored Mails\n============\nStored [INBOX]: 20\nStored [Junk]: 24\n```\n\n\n## Architecture\n\nThe core of `gowatch` is the following pipeline.\n\n```\n  +------------+     +------------+     +------------+\n  +   Parser   | --\u003e |   Mapper   | --\u003e | Summarizer |\n  +------------+     +------------+     +------------+\n```\n\nWhile each `parser.Parser` creates `logentry.LogEntry` instances (by parsing logfiles) and sends them into the pipeline, the `mapper.Mapper`s will modify these log entries and pass them to the summarizers. Each `summary.Summarizer` produces human readable output, e.g. by counting occurences or listing search results. The concatenation of output might then be given to the user, e.g. by mail.\n\nThe names are more specific than what [Logstash](http://logstash.net) uses, and this is by intention. The aim was to build an application specifically for creating reports from logfiles. Further usecases, like network support etc., are out of scope.\n\n\n## Related work\n\n* **[logwatch](http://logwatch.sourceforge.net)** is widely used by Linux server administrators round the world, and so\n  did I use it for many years. However, I find it to be not flexible enough in its configuration, and as soon as I want\n  to change something, I always felt it was hard to extend and hard to change. Gowatch aims to be flexible, configurable\n  and extendable.\n* **[logstash](http://logstash.net)** is a log processor, that became very popular in combination with the search serer\n  [elasticsearch](http://www.elasticsearch.org). Those are really great tools, especially for usage in large server\n  parks. However, they need several Gigabytes of RAM and that's just far too heavy for my small tiny server. Gowatch\n  aims to be a small and easy-to-be-used tool with low requirements, just as logwatch always was.\n\n## 3rd Party Libraries\n\n[Standing on the shoulders of giants](http://en.wikipedia.org/wiki/Standing_on_the_shoulders_of_giants), this wouldn't\nbe what it is without:\n\n* **[gemsi/grok](http://github.com/gemsi/grok)** is a great Grok implementation in Go, throughoutly tested.\n  Grok itself is a simple DRY method for log parsing, known from\n  [logstash](http://logstash.net/docs/latest/filters/grok), but there is also a standalone C implementation -- see for\n  [jordansissel/grok](https://github.com/jordansissel/grok).\n* **[stretchr/testify](http://github.com/stretchr/testify)** brings assertions to Go, just the way they feel right.\n  Great for testing!\n* **[go-yaml/yaml](https://github.com/go-yaml/yaml)** (un)marshalls YAML files into native Go data structures with few\n  more than a single line of code. gowatch wouldn't have the configuration files it has without this library.\n\n...among others. Thanks a lot for your work!\n\n## License\n\nLicensed under MIT, see for [LICENSE](LICENSE) file.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffxnn%2Fgowatch","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ffxnn%2Fgowatch","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffxnn%2Fgowatch/lists"}