3

There are a few cases, such as netfilter logs, where it would be great if I could send the report logcheck is about to send through a filter.

logcheck(8) doesn't seem to describe anything like this, nor does the man page for logcheck.conf.

2

Not directly with logcheck. The only thing you have at your disposal is to filter lines from log files. There's a decent collection of filter examples here i this article titled: logcheck — various filters.

However, given logcheck is merely a shell script you could modify it and create your own version. You could also modify the cronjob that typically comes with the logcheck package and run it via STDOUT, filtering the contents, and then sending that out via email yourself manually.

( $ /usr/sbin/logcheck -o | ...your filter... ) | mail ...

Custom filters

For setting up filters you can stick rule files under logcheck's directory tree in the appropriate directory to get it to filter out messages that aren't relevant.

$ ls -ld /etc/logcheck/*
drwxr-xr-x. 2 root root 4096 May 30 16:36 /etc/logcheck/cracking.d
drwxr-xr-x. 2 root root 4096 May 30 16:36 /etc/logcheck/ignore.d.paranoid
drwxr-xr-x. 2 root root 4096 May 30 16:36 /etc/logcheck/ignore.d.server
drwxr-xr-x. 2 root root 4096 May 30 16:36 /etc/logcheck/ignore.d.workstation
-rw-r--r--. 1 root root 2647 Feb 16  2013 /etc/logcheck/logcheck.conf
-rw-r--r--. 1 root root  133 Feb 16  2013 /etc/logcheck/logcheck.logfiles
drwxr-xr-x. 2 root root 4096 May 30 16:36 /etc/logcheck/violations.d
drwxr-xr-x. 2 root root 4096 May 30 16:36 /etc/logcheck/violations.ignore.d

For example it comes with filter files for many of the popular services already:

$ ls /etc/logcheck/ignore.d.server/ | head -10
acpid
amandad
amavisd-new
anacron
anon-proxy
apache
apcupsd
arpwatch
asterisk
automount

So you could incorporate rules to filter things out there.

$ more /etc/logcheck/ignore.d.server/apache 
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ apache: nss_ldap: reconnect(ing|ed) to LDAP server(\.\.\.| after [0-9]+ attempt\(s\))$
  • Thanks for taking the time to answer. Sorry if my question was unclear. I know how to filter them out. What I don't know is how to manipulate them in a way that makes (some of) them more readable in my MUA. Modifying the cron job is not the perfect solution, but perhaps I can "divert" the execution (given I am on Ubuntu). – 0xC0000022L May 31 '14 at 2:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.