Re: [sec] Re: failed root login attempts
On Sun, 19 Sep 2004, martin f krafft wrote:
> > If you ask me, logcheck should learn how to evaluate log messages in
> > their context...
If you want to have instant alerts of problems then logcheck is
what you want. If you to ignore some things and still receive timely
alerts then you're looking at something which can read your mind!
If you can define what it is you don't want to see then logcheck
can handle that via the pattern files in logchecks ignore.d/ hierarchy.
It almost sounds like you're wanting to use something different
anyway, perhaps logwatch is the package you're looking for?
(Not in stable unfortunately, but a backport is trivial).
Steve
--
Reply to: