Re: logcheck

[Stefan Schleifer <stefan.schleifer@cubit.at>]

Antti Tolamo wrote:
> 
> At 16:23 6.2.2001, Robert Ramiega wrote:
> >On Tue, Feb 06, 2001 at 04:03:13PM +0200, Antti Tolamo wrote:
> > >
> > >
> > > I just noticed that my logcheck does double entries(same
> > > entry is inserted twice). First comes one hour of entries,
> > > then it is insterted again.
> > >
> > > What could cause this?
> >  Bad configuration ;o)))))
> >  On a serious side... Logcheck scans several logfiles some information is
> >  stored in more than one logfile (f.ex auth.log and syslog). Have a look at
> >  /etc/logcheck/logcheck.logfiles and/or
> >  /etc/syslog.conf
> >  (the first one will show You which logfiles are beeing scanned, the second
> >  one will let You configure syslogd and what gets logged where)
> 
> I don't have logcheck.logfile at all???

neither do I. I have the list of logfiles in /usr/sbin/logcheck.sh
maybe check there for the file names.


> 
> What files there should be anyway? I have
> no real way of knowing what should come with it.


the important files are


/etc/logcheck/logcheck.logfiles
/etc/logcheck/logcheck.conf
/etc/logcheck/logcheck.hacking
/etc/logcheck/logcheck.hacking.ignore    (not standard, added manually)
/etc/logcheck/logcheck.violations
/etc/logcheck/logcheck.violations.ignore
/etc/logcheck/logcheck.ignore.paranoid
/etc/logcheck/logcheck.ignore.server
/etc/logcheck/logcheck.ignore.workstation
...
/etc/cron.d/logcheck                                                                                
...
/usr/sbin/logcheck.sh
/usr/sbin/logtail


Stefan

> 
> I did install the logcheck debian package from debian mirror
> in Finland.
> 
> Antti
> 
> --
> To UNSUBSCRIBE, email to debian-security-request@lists.debian.org
> with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

-- 
system engineering             +43-1-718-98-80
CUBiT IT Solutions         http://www.cubit.at