Re: logcheck

[Aaron Brashears <gila@gila.org>]

On Wed, Apr 18, 2001 at 04:34:05PM -0700, aphro@portal.aphroland.org wrote:
> i have logcheck installed on a few systems. i cleared out most
> of the things generating the reports but..it still emails me
> every hour and the only contents of the email are the log entries
> of it sending the previous email(messages about root sending
> email to me using postfix). any way to get rid of those so only
> emails that contain something useful are generated? being emailed
> by a program about activities it performs isnt ideal for me :)

After installing logcheck, the first thing I did was reduce the
frequency of it spitting out emails. You can read up about this by
reading the cron manpages and editing /etc/cron.d/logcheck. I modified
it so that it sent out the email every day 5 minutes past midnight:

5 0 * * *       root    test -x /usr/sbin/logcheck.sh && nice -n10 /usr/sbin/logcheck.sh


Another thing you want to keep in mind is that it only checks logs
from other services that are running. So if you aren't running
anything that logs stuff (apache, ftp, mail, ippl, etc) then you'll
never see any logs.