I'm thinking about using the logcheck [1] program for intrusion detection, and was wondering if anyone here uses it. If so, have you modified the keyword filter files? I like logcheck because it is simple. But it's not packaged for Debian, so maybe no-one here uses it. If not, what tool do you recommend for intrusion detection? Regards, Mark [1] http://www.smittyware.com/contrib/psionic.php