Re: logcheck(1) in bookworm 12.5 /etc/logcheck/logcheck.logfiles.d/syslog.logfiles

[Andy Smith <andy@strugglers.net>]

Hi,

On Thu, Mar 14, 2024 at 04:18:26PM -0600, Charles Curley wrote:
> Interesting. My logcheck instance works just fine, andmakes no such
> complaints. However, my
> /etc/logcheck/logcheck.logfiles.d/syslog.logfiles has them commented
> out.

You are probably using the journald support as configured in
/etc/logcheck/logcheck.logfiles.d/journal.logfiles.

> # (If your system does not use a syslog daemon you
> # can comment these lines out)
> # /var/log/syslog
> # /var/log/auth.log
> root@issola:~# 
> 
> So you might do the same.

OP would also want to check the journal.logfiles file I mentioned
above to check that it is actually set up to read from journald.

Good to know that logcheck has patterns for matching journald logs
though.

Thanks,
Andy

-- 
https://bitfolk.com/ -- No-nonsense VPS hosting