Skip to content

Instantly share code, notes, and snippets.

@simonLeary42

simonLeary42/logcheck-notes.md

Created September 15, 2025 16:42
Show Gist options
  • Save simonLeary42/14ed857d94c5d1ce84ffa227f62d1aa0 to your computer and use it in GitHub Desktop.
Save simonLeary42/14ed857d94c5d1ce84ffa227f62d1aa0 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. simonLeary42 revised this gist Sep 15, 2025. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion logcheck-notes.md
    View file
    Original file line number Diff line number Diff line change
    @@ -2,7 +2,7 @@

    * default
    * there are no include rules
    * exclude rules is one of `ignore.d.workstation`, `ignore.d.server`, `ignore.d.paranoid`
    * exclude rules are in one of `ignore.d.workstation`, `ignore.d.server`, or `ignore.d.paranoid`
    * exclude rule directory is based on "report level" in `logcheck.conf`
    * subject line option in `logcheck.conf` is `EVENTSUBJECT`
    * security/violations
  2. simonLeary42 created this gist Sep 15, 2025.
    15 changes: 15 additions & 0 deletions logcheck-notes.md
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,15 @@
    3 layers:

    * default
    * there are no include rules
    * exclude rules is one of `ignore.d.workstation`, `ignore.d.server`, `ignore.d.paranoid`
    * exclude rule directory is based on "report level" in `logcheck.conf`
    * subject line option in `logcheck.conf` is `EVENTSUBJECT`
    * security/violations
    * include rules are in `violations.d`
    * exclude rules are in `violations.ignore.d`
    * subject line option in `logcheck.conf` is `SECURITYSUBJECT`
    * attack/cracking
    * include rules are in `cracking.d`
    * exclude rules are in `cracking.ignore.d`
    * subject line option in `logcheck.conf` is `ATTACKSUBJECT`