Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In order to learn more about what is logged by my desktop machine, I'd like to set up something better than a casual grep command to see what's going on. A typical use case would be to send an email with a warning if more than X SSH login attempts failed within Y minutes for user username.

To be clear, this is not for web server logs, which most *nix log analysis tools seem to be focusing on. Also, I would like this system to be live, not just a grep in cron, in order to be able to catch events like shutdown now before the machine goes down.

LogSurfer might be the right thing for me, but I'd like to know of other, similar tools if there are any.

Of course, I'm only interested in FLOSS.

share|improve this question
up vote 2 down vote accepted
  • logwatch is a common solution for log analysing and monitoring
  • logsentry is also a classic package, targeted mainly at security

(Don't be put off by the lacks of shiny websites - many well-established, BSD-derived tools just aren't trying to promote themselves - it's enough for them to be known by experts.)

share|improve this answer
Looks like logwatch is meant to be run "after the fact". Is it possible to plug this into the live syslog stream? – l0b0 Nov 25 '11 at 11:59
Looks like the Logcheck part of logsentry has moved; the SourceForge tarball is from 2003. – l0b0 Nov 25 '11 at 12:11
Looks like logcheck has to be run periodically, and can't run live because logtail doesn't take input from stdin. – l0b0 Nov 25 '11 at 12:22

We use SEC at my current job. It's functionally similar to LogSurfer, in that it watches log files in real time ("tail -f" style), and it can act on any arbitrary event or combination of events. Like LogSurfer, you match the lines you're interested in using regular expressions, so you aren't limited to a particular log format.

Another one I ran across while looking for a link for SEC is LoGS. I've never seen or used it, but if you're in the evaluation stage, if might be worth a look, too.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.