NAME

       trackalert - daemon to track and alert on long-term abuse trends for logins

SYNOPSIS

       trackalert [OPTION]...

DESCRIPTION

       trackalert   implements   a  simple  HTTP  server  that  accepts  JSON  formatted  commands  that  report
       successful/unsuccessful logins.

       trackalert can act as both a client and server.  As a server it typically  runs  under  systemd  control,
       although  it  can also be run as a traditional daemon or in `interactive' mode.  As a client, it connects
       to a trackalert server and provides the same interactive commands.

       trackalert is scriptable in Lua, see the trackalert.conf  file  for  a  simple  example.   In  fact,  all
       configuration is done using the Lua language, as trackalert.conf is simply a Lua script.

SCOPE

       trackalert  depends on a system to feed it login reports, which will typically be wforce (configured with
       a webhook that triggers only on “report”) integrated with it using the HTTP/JSON API.

OPTIONS

       -c     Act  as  a  client,  connecting  to  a  trackalert  instance  at  the  IP/Port  specified  in  the
              `controlSocket' function in trackalert.conf.  A custom configuration file can be specified.

       -C,–config FILE
              Load  configuration  from  FILE.   Note  that  trackalert  will  chdir  to the directory where the
              configuration file is located.

       -R,–regexes FILE
              Read device parsing regexes from FILE (usually regexes.yaml).

       -s     Run in foreground, but do not spawn a console.   Use  this  switch  to  run  trackalert  inside  a
              supervisor (use with e.g. systemd and daemontools).

       -d,–daemon
              Operate as a daemon.

       -e,–execute CMD
              Connect to trackalert and execute CMD.

       -f,–facility FACILITY NAME
              Log using the specified facility name, e.g. local0

       -l,–loglevel <0-7>
              Logs sent to stdout will be filtered according to the specified log level, matching the equivalent
              syslog level (0 - Emerg to 7 - Debug).

       -h,–help
              Display a helpful message and exit.

CONSOLE COMMANDS

       The following commands can be run from the console when trackalert is started with the -c option.

       • makeKey()  -  Returns  a  string to be used in the setKey() function in trackalert.conf to authenticate
         sibling communications.  All siblings must be configured with the same key.

                  > makeKey()
                  setKey("CRK+jKBpzXNLmM2A4C7OpFCBxiwpYlreCWgGEAIKAQI=")

       • stats() - Returns statistics about the trackalert process.  For example:

                  > stats()
                  40 reports

       • showACL() - Returns the configured ACLs for the trackalert server.

                  > showACL()
                  127.0.0.0/8
                  10.0.0.0/8
                  100.64.0.0/10
                  169.254.0.0/16
                  192.168.0.0/16
                  172.16.0.0/12
                  ::1/128
                  fc00::/7
                  fe80::/10

       • showCustomWebHooks() - Returns information about configured custom webhooks.  For example:

                  > showCustomWebHooks()
                  ID        Name                 Successes Failures  URL
                  1         mycustomhook         10         0         http://localhost:8080/webhook/regression

       • showPerfStats() - Returns information about performance statistics.  Stats beginning with WTW refer  to
         the  time  that worker threads waited in a queue before running.  Stats beginning with WTR refer to the
         time that worker threads took to run.  Each stat is in a bucket, where each bucket  represents  a  time
         range  in  ms, e.g. 0-1.  A server that is not overloaded will have most stats in the 0-1 buckets.  For
         example:

                  > showPerfStats()
                  WTW_0_1=2939287
                  WTW_1_10=9722
                  WTW_10_100=4
                  WTW_100_1000=0
                  WTW_Slow=0
                  WTR_0_1=2939229
                  WTR_1_10=2837
                  WTR_10_100=131
                  WTR_100_1000=0
                  WTR_Slow=0

       • showCommandStats() - Returns information about the number of REST API commands that have  been  called,
         including  custom endpoints.  Stats are for the previous 5 mins, and due to the counting method, may be
         approximate when the numbers get very large.  For example:

                  > showCommandStats()
                  addBLEntry=0
                  allow=23942
                  delBLEntry=0
                  getBL=0
                  getDBStats=0
                  ping=300
                  report=19232
                  reset=24
                  stats=92
                  customEndpoint=2821

       • showCustomStats() - Returns information about custom stats that are incremented from  Lua.   Stats  are
         for  the  previous 5 mins, and due to the counting method, may be approximate when the numbers get very
         large.  For example:

                  > showCustomStats()
                  custom1=0
                  custom2=8405

       • reloadGeoIPDBs() - Reload all GeoIP DBs that have been initialized.  For example:

                  > reloadGeoIPDBs
                  reloadGeoIPDBs() successful

       • showVersion() - Returns the current version of the trackalert server.  For example:

                  > showVersion()
                  trackalert 1.2.0

SEE ALSO

       trackalert.conf(5) trackalert_api(7)

AUTHORS

       Open-Xchange.

                                                      2018                                         TRACKALERT(1)