I’d like to more easily create logcheck rules from log messages.
Ideally I’d like to have something set up such that I just take a logcheck message I receive, and pipe it to some tool, and it spits out a logcheck rule with the regular-expression bits in the right places. And then I review that and tweak it as needed before installing it along with my existing rules.
The specific context is that I’m currently getting a bunch of messages like this:
Sep 19 06:48:51 sideshowbarker kernel: TCP: drop open request from 186.2.166.213/31877
I already understand very well how from that to manually construct a logcheck rule that will filter that kind of message out. I just don’t want to it manually. I’d rather automate it, at least partially.
