Re: Logging atempts

[Arthur Korn <arthur@korn.ch>]

Hello.

balexander@sonsofthunder.yi.org schrieb:
> On Sun, Jul 16, 2000 at 04:21:28PM +0000, Patrick Barr wrote:

> If you are looking to see if someone is getting through your ipchains and
> getting stopped by tcp_wrappers, you can change your hosts.deny from
> ALL: ALL to
> 
> ALL: ALL: spawn ( \
> echo -e "\n\
> TCP Wrappers\:  Connection refused\n\
> By\:                    $(uname -n)\n\
> Process\:               %d (pid %p)\n\
> User\:                  %u\n\
> Host\:                  %c\n\
> Date\:                  $(date)\n\
> " | /bin/mail -s "Connection to %d blocked" root)
> 
> This will send you an email whenever someone gets through to
> tco_wrappers.

You should first try something like this:

ALL:ALL: severity mail.info

This will log everything maching it to the facility.level
specified (hosts_options(5)). Syslog can generally better cope
with many messages.

ciao, 2ri