Tag Info

Hot answers tagged

19

Overall, the available documentation for Logwatch lacks adequate explanation and is often far too vague. I pieced together some useful examples, and have reduced the Logwatch noise by over 95%. Here's what I have found. Keep in mind that you can find some Logwatch documentation at /usr/share/doc/logwatch-*/HOWTO-Customize-LogWatch, and it contains a few ...


6

You don't, really, anymore than you can stop regular users guessing at links. Correctly secure your content and this won't be an issue anyway. Obscure links are not a safe way to hide things. You can ensure you've got a correctly configured robots.txt - that'll stop most of the legit bots.


6

When the ssh client does a "normal" connection shutdown, it sends a packet with a message in it. When the ssh daemon gets such a packet when it's not expecting it -- in this case, before the user managed to authenticate -- it logs the message. (Older versions of OpenSSH did not do this.) So your surmise is exactly correct: it's a side effect of a ...


5

That is not a hard error at all. ext3 has a parameter to configure "every X mounts or Y days the filesystem should be checked". Your "error" just says that exactly this is the case. There is nothing to worry about. You can configure this behaviour with tune2fs. If you want an fsck every 100 mounts: tune2fs -c 100 /dev/sdx1 And to set the time limit (in ...


5

Assuming you're using rsyslog, which is the default on Debian squeeze: Use rsyslog's mail output module to send yourself email. You can configure which messages get sent to you in the usual way: *.emerg :ommail:;mailBody or by matching text in the log message: if $msg contains 'hard disk fatal failure' then :ommail:;mailBody


5

A starter point is the LogWatch Documentation page for HOWTO Customize LogWatch. Read through points 4, 5 and 6. Another brief description of the LogWatch files -- Managing your log files. And, a Metalog wiki reference on how to setup logwatch to read metalog generated log files.


5

It was an empty request. %r is actually the first line of their request, which means they sent an empty request. In other words, no headers, no body, nothing. It was likely a socket connection to port 80. The 301 was likely not to the website--remember, they have nothing defined in their request, including the desired file on your web site. Exactly. - ...


4

There is a tool called logrotate which is designed to do exactly what you want to do by hand. Depending on how you configure it, it will e.g. once a day create a new log file and renames to old one to logfile.1, logfile.2 etc. And the oldest one gets then deleted. Depending on your situation you maybe want to backup the log files to another server as well. ...


4

The log files you have provided should be picked up without you making any changes because of the default config LogFile = httpd/*access_log LogFile = apache/*access.log.1 LogFile = apache/*access.log LogFile = apache2/*access.log.1 LogFile = apache2/*access.log LogFile = apache-ssl/*access.log.1 LogFile = apache-ssl/*access.log But is you want to be more ...


4

Logwatch provides the *Remove shared script which will tell Logwatch to ignore lines which contain a particular string (e.g. grep -v), before they are processed later on. Copy /usr/share/logwatch/default.conf/services/sshd.conf to /etc/logwatch/conf/services/sshd.conf Add the following lines, which will tell logwatch to not process log entries for lines ...


4

One way would be to use fail2ban and configure it to match your needs. In short: among the other its features, fail2ban can tail your Apache access log and after X amount of Y kind of matches can put the accessing client to a Z minutes penalty by blocking the client IP for XX minutes. Usually enough to scare the bots away, but beware, this can very well ...


4

Your current timezone is GMT, why did you set /etc/timezone to "+0800"? perldoc Date::Manip The following time zone names are currently understood (and can be used in parsing dates). These are zones defined in RFC 822. Universal: GMT, UT US zones : EST, EDT, CST, CDT, MST, MDT, PST, PDT Military : A to Z (except J) ...


3

LogWatch runs once per day, from cron -- If you want more frequent notifications you can run LogWatch more frequently, but that this will send you everything that LogWatch normally complains about. If you want to watch for specific messages you should be using something more sophisticated than LogWatch (syslog-ng with custom filters/actions springs ...


3

You should not be concerned about "authentication failures" for root - there are myriads of malware and scriptkiddies tools trying root passwords on every host they can reach. As long as you do not allow direct root logins and / or have a sufficiently complex non-dictionary root password, this is nothing to worry about. The root -> nobody sessions are ...


3

Yes - logwatch is often too noisy. You already mentioned disabling checks completely. If you don`t want to do that you have to prevent certain events to appear. For instance - it is not interesting if nagios connects via ssh to a DMZ system. But is is interesting if there are other logins via ssh. We use rsyslog instead of ksyslogd (first install rsyslog, ...


3

Deferred mail is simply mail that was unable to deliver to the sender and has been added to the mail queue ( you can view it by mailq or postqueue -p). You can try to resend (flush) all those messages with sendmail -q, which will attempt to send again. One reason it could be doing this is if your server's DNS listings (/etc/resolv.conf) are not ...


3

Simply "someone" tried to access those files via URL. Actually, it's probably an automated script looking for usable exploits. While those particular request are obviously targeted at Windows systems, I suggest you to install and configure apache module mod_security to catch and block those requests (and those targeted to linux system, too!). EDIT ...


3

It is logwatch which knows about some well-known hacks. These are hard-coded into logwatch. Check the file services/http for the line which starts with my @exploits. You will see these are just some very simple patterns which are detected. If the webserver doesn't respond with an error status, logwatch considers the hack successful. This is similar to a ...


3

OK, since we've established that your disks are not melting themselves because you can touch them, I'd say Jason has the right idea with tweaking LogWatch. It's been a while since I've looked at LogWatch (I think it's pretty lousy and usually disable it), but you can definitely disable the temperature alarms using ignore.conf (there's some info about that in ...


3

The 113 authentication errors match up with the 113 SASL errors. SASL authentication failure: cannot connect to saslauthd server: Permission denied There seem to be many different reasons that can cause this error message. See if any of those fix your SASL problem. Is that 92.24.80.207 IP address you? If not, someone may be trying out passwords to see ...


2

You don't have to install Postfix. Postfix is not a dependency of logwatch. The actual dependency is postfix | mail-transport-agent, so any package that provides mail-transport-agent will satisfy the dependency. Now, the problem is, you're not using a packaged MTA. I would recommend ditching this sendEmail thing and instead install a packaged MTA that ...


2

It actually means the opposite to what you suggested: the person in Taiwan accessed (or attempted to access) eBay via your server. It means that someone was using your machine as an open proxy. Most likely they were probing to see if you had an open proxy configured. The fact that the message says "attempted" would suggest that they didn't succeed, but a ...


2

As a point of interest I followed option 2 form the answer by Stefan Lasiewski but for my purposes I wanted to only include specific lines rather than exclude all the noise I didn't want. I was configuring vsftpd so I created /etc/logwatch/conf/services/vsftpd.conf and instead of using something like *Remove = testuser which removes rows which include the ...


2

Try this (works for me): Define LogFormat in your httpd.conf as LogFormat "%h %t [%V] \"%r\" %>s \"%{Referer}i\"" With this particular case, you'll have remote_address, date/time, [The server name according to the UseCanonicalName setting], request, satus code and Referer (that's my desired format) and then put $LogFormat "%h %t %V \"%r\" %>s ...


2

There are quite a few addons you can use with Nagios to extend its functionality and therefore customize it to fit your needs. Check out the Reporting addons page of Nagios Exchange for the addons specific to providing more extensive reporting capability. Specifically, you might want to look at Nagios Email Reporter. This perl script can request an ...


2

You have several questions in the same message, you might get better results splitting them up. However, I will try to answer the sshd question and the unmatched one. I get several thousands of failed sshd attempts per day, sometimes more. I ignore them because I use secure passwords, do not have "guest" accounts which have weak passwords, and do not ...


2

I can't immediately speak for the IMAP entries, but the sshd logs are very characteristic of someone (well, some program) trying to gain access by brute-force password guessing. In my opinion, you should do something about that, or they will eventually guess someone's bad password, and even until then dealing with each of these attempts uses server ...


2

To give an example of Zypher's answer, what I do is forward *.debug to @loghost on all nodes. The loghost node runs syslog-ng, which has the ability to split out by source system. (I presume other modern syslog replacements like rsyslog can do similar things.) I have a sample syslog-ng.conf file for solaris, but changing it around to be for linux isn't ...


2

There are two different aspects here: Logwatch by default is boring, but its goal is to alert on suspicious patterns on log files. If you don't edit the different rules to make it more interesting, by default it will send mails with what the creator found useful, with his own infrastructure and experience. It is possible to update the different services, ...


2

Logwatch is usually started by cron. Check directory /etc/cron.daily/ for a script which launches logwatch. In RHEL there is a symlink /etc/cron.daily/0logwatch which points to /usr/share/logwatch/scripts/logwatch.pl You can remove this link (0logwatch) from /etc/cron.daily to prevent logwatch from running every day: rm /etc/cron.daily/0logwatch To ...



Only top voted, non community-wiki answers of a minimum length are eligible