Skip to content

Instantly share code, notes, and snippets.

@simonLeary42

simonLeary42/logcheck-notes.md

Created September 15, 2025 16:42
Show Gist options
  • Save simonLeary42/14ed857d94c5d1ce84ffa227f62d1aa0 to your computer and use it in GitHub Desktop.
Save simonLeary42/14ed857d94c5d1ce84ffa227f62d1aa0 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
logcheck-notes.md

3 layers:

  • default
    • there are no include rules
    • exclude rules are in one of ignore.d.workstation, ignore.d.server, or ignore.d.paranoid
      • exclude rule directory is based on "report level" in logcheck.conf
    • subject line option in logcheck.conf is EVENTSUBJECT
  • security/violations
    • include rules are in violations.d
    • exclude rules are in violations.ignore.d
    • subject line option in logcheck.conf is SECURITYSUBJECT
  • attack/cracking
    • include rules are in cracking.d
    • exclude rules are in cracking.ignore.d
    • subject line option in logcheck.conf is ATTACKSUBJECT
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment