Logcheck keeps track of your logs, emails you when things get suspicious

(written by lawrence krubner, however indented passages are often quotes). You can contact lawrence at: lawrence@krubner.com, or follow me on Twitter.

I only just discovered logcheck, but now I want to use it on all of my servers:

How Logcheck Protects Your Server
It turns out that Logcheck is a pretty simple tool. All it does is periodically check the log files you specify. It filters out the uninteresting parts and emails you what is left. It is smart enough to avoid mailing you the same information multiple times by keeping a “bookmark” for each log file. This way it can only email you newer entries — those have been written after the last log check.

The really valuable part in the Logcheck distribution is its rule database that distinguishes between the interesting and uninteresting log entries. On Ubuntu it is provided in a separate package: logcheck-database and it contains rules for many daemons you could have running on your system: cron, bind, postfix, and whatnot. I like that a lot and I can think about several projects where I can install and use the database in a separate program that analyzes log entries and sends out alerts.

Post external references

  1. 1
    http://stackful-dev.com/keep-an-eye-on-your-linux-servers-with-logcheck.html
Source