Tools to Help with Logging

Logcheck

Logcheck is a public-domain tool used to examine syslog and any other logfiles. When something suspicious is found, it sends an e-mail message alerting the UNIX administrator that something is up. Logcheck employs a filter file containing keywords; when a log entry containing a keyword is found, a message is sent. Logcheck utilizes the “report everything that is not explicitly ignored” feature— a nice feature, since it can be difficult to know in advance every possible type of message that could be logged. It is run from cron as often as needed (once per hour is the recommended minimum frequency).

This is a description of Logcheck configuration files.