Edit Rename Changes History Upload Download Back to Top

logcheck

logcheck scans logs looking for significant issues and send out an email summary. We also use syslog-summary to tidy up duplicate lines in the reports, though administrators may choose to leave syslog-summary off if it interferes with identifying specific problems (e.g. timestamps are lost by syslog-summary).

The Basics

You may wish to, optionally, install syslog-summary

Tuning

By default logcheck will report on all kinds of things that are not interesting - or at least not critical. Logcheck can be told to ignore some things in the logs by adding stanzas to *ignore* configuration files:

Here are example stanzas that may be added. Only add them in response to too much traffic appearing in the emailed log reports:

/etc/logcheck/ignore.d.server/local (for "System Events")

sshd\[[0-9]+\]: error: Could not get shadow information for NOUSER
sshd\[[0-9]+\]: Failed password for illegal user .* from .* port .* ssh2
sshd\[[0-9]+\]: Failed password for user .* from .* port .* ssh2
sshd\[[0-9]+\]: Did not receive identification string from .*
sshd\[[0-9]+\]: Illegal user .* from .*
sshd\[[0-9]+\]: Address .* maps to .*, but this does not map back to the address - POSSIBLE BREAKIN ATTEMPT.
ntpd\[[0-9]+\]: frequency error .* PPM exceeds tolerance 500 PPM

/etc/logcheck/violations.ignore.d/local (for "Security Events")

sshd\[[0-9]+\]: Failed password for illegal user .* from .* port .* ssh2
sshd\[[0-9]+\]: Failed password for user .* from .* port .* ssh2
sshd\[[0-9]+\]: Illegal user .* from .*
sshd\[[0-9]+\]: reverse mapping checking getaddrinfo for .* failed - POSSIBLE BREAKIN ATTEMPT.

Problems

If you get a message like this instead of a logcheck report:

Warning: If you are seeing this message, your log files may not have been
checked!

Details:
Failed to get lockfile: /var/lock/logcheck/logcheck.lock
Make sure the /var/log/logcheck/ directory is owned by logcheck and in the group logcheck. If not: chown logcheck:logcheck /var/lock/logcheck/ as root.


Edit Rename Changes History Upload Download Back to Top