Logcheck helps spot problems and security violations in your logfiles automatically and will send the results to you in e-mail.

Installation

1

apt-get install logcheck

E-Mail recipients will be configured in “/etc/aliases”.

Logcheck config is in “/etc/logcheck/logcheck.conf”, depending on setting of:

1
2
3
4

INTRO=1
REPORTLEVEL="server"
SENDMAILTO="logcheck"
ADDTAG="yes"

Some different rules from the following directories are used:

1
2
3
4
5
6
7
8
9

/etc/logcheck/*
cracking.d
cracking.ignore.d
ignore.d
ignore.d.paranoid
ignore.d.server
ignore.d.workstation
violations.d
violations.ignore.d

Define your ignore rules
When you are using server reporting level, put your local-rules file in “/etc/logcheck/ignore.d.server/local-rules”

Sample content of “/etc/logcheck/ignore.d.server/local-rules”:

1
2
3
4
5
6

^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: kernel time sync status change
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: success resolving
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: connection refused resolving
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ imapd: DISCONNECTED
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ imapd: TIMEOUT
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ imapd: LOGOUT

For testing of your rules you can use:

1

egrep -f /etc/logcheck/ignore.d.server/local-rules /var/log/syslog

That will show only messages that will be suppressed and will NOT be mailed to you.

By the way a manual logcheck-run can be started too, and you must not wait until the next cron:

1

su -s /bin/bash -c "/usr/sbin/logcheck" logcheck