We are using the
logcheck package in Debian for log-monitoring.
If I understand it correctly, logcheck monitors the logs, filters out known (normal & unimportant) messages and triggers a mail if any message occurs which might indicate a problem.
Logcheck is sending me an excerpt of the log (System Events). But the log does not look suspicious. It contains messages like:
Jul 31 08:22:03 example pop3d: Connection, ip=[::ffff:123.456.789.123]
I think logcheck sends also the surrounding part of the log if there is a line that triggered the notification - but how can I find out, which exact line triggered this mail?