###################################################################### SYNOPSIS -------- Logcheck compares recent log entries with a series of sets of egrep pattern-matching rules that flag them as urgent or filter them out as routine, and mails the results to the administrator. ====================================================================== SCHEDULING ---------- By default logcheck runs every hour just off the hour, and after every reboot. If this produces too many mailings then you can reduce the frequency, but it's often better to tune the filtering rules instead (see below on REPORTLEVELS). On the other hand if you need to be sure of spotting security incidents while they're happening then the shorter the interval the better, as long as runs don't start overlapping. ====================================================================== LOG ENTRIES ----------- These are taken from a specified set of logfiles (usually syslog and auth.log); a special Perl utility named "logtail" is used which "bookmarks" its place in the logs, so that events aren't reported twice in successive logcheck runs. The offset records are stored as (eg) "/var/lib/logcheck/offset.var.log.syslog"; lines to be considered by logcheck are copied into tempfiles in the working directory "/var/tmp/logcheck". See the corresponding README for logtail for further notes on complications such as log-rotation. ====================================================================== RULES DIRECTORIES ----------------- Installing "logcheck" should also have pulled in the package "logcheck-database", which provides pattern-matching "rules" files; see the corresponding README for that package for details of how they are organised. ====================================================================== REPORTLEVEL ----------- The config-file setting new users are most likely to need to modify is that of REPORTLEVEL. This is a three-way division between high, medium and low "security ratings", not to be confused with the three filtering layers used by the logcheck-database directories. Reportlevels only affect the handling of the leftover log-messages of the final "System Events" layer, functioning rather like verbosity settings: "paranoid" is "high verbosity" - meaning that only the minimal set of filters in ignore.d.paranoid should be applied. This is appropriate for high-security machines such as firewalls, which should anyway be running as few services as possible. "server" means that logcheck should then also go on to apply the more selective set of filters in ignore.d.server; as the name implies, this is intended to cut out the routine messages such as "so-and-so logged in". "workstation" means that as well as applying the ignore.d.paranoid and ignore.d.server filters, logcheck should run through ignore.d.workstation. This filters a great many everyday log messages (such as anything matching "kernel:"), and is only appropriate for relatively sheltered, non-critical machines. Don't set the REPORTLEVEL to "paranoid" if the result is more output than you can handle - messages that aren't going to be read might as well have stayed in "/var/log/*". However, as long as you're prepared to tune logcheck's output with local filters, a verbose REPORTLEVEL can be a valuable debugging aid even on an unnetworked home PC; see the logcheck-database README section on WRITING RULES. ######################################################################
