Re: logcheck(1) in bookworm 12.5 /etc/logcheck/logcheck.logfiles.d/syslog.logfiles

From	Andy Smith <andy@strugglers.net>
Newsgroups	linux.debian.user
Subject	Re: logcheck(1) in bookworm 12.5 /etc/logcheck/logcheck.logfiles.d/syslog.logfiles
Date	2024-03-14 23:40 +0100
Message-ID	<Ii1TX-gJFS-3@gated-at.bofh.it> (permalink)
References	<IhY01-gHn3-3@gated-at.bofh.it> <Ii1AB-gJzE-5@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

Hi,

On Thu, Mar 14, 2024 at 04:18:26PM -0600, Charles Curley wrote:
> Interesting. My logcheck instance works just fine, andmakes no such
> complaints. However, my
> /etc/logcheck/logcheck.logfiles.d/syslog.logfiles has them commented
> out.

You are probably using the journald support as configured in
/etc/logcheck/logcheck.logfiles.d/journal.logfiles.

> # (If your system does not use a syslog daemon you
> # can comment these lines out)
> # /var/log/syslog
> # /var/log/auth.log
> root@issola:~# 
> 
> So you might do the same.

OP would also want to check the journal.logfiles file I mentioned
above to check that it is actually set up to read from journald.

Good to know that logcheck has patterns for matching journald logs
though.

Thanks,
Andy

-- 
https://bitfolk.com/ -- No-nonsense VPS hosting

Back to linux.debian.user | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

logcheck(1) in bookworm 12.5 /etc/logcheck/logcheck.logfiles.d/syslog.logfiles conover@panix.com (John Conover) - 2024-03-14 19:30 +0100
  Re: logcheck(1) in bookworm 12.5  /etc/logcheck/logcheck.logfiles.d/syslog.logfiles Greg Wooledge <greg@wooledge.org> - 2024-03-14 20:20 +0100
  Re: logcheck(1) in bookworm 12.5  /etc/logcheck/logcheck.logfiles.d/syslog.logfiles Dan Ritter <dsr@randomstring.org> - 2024-03-14 20:40 +0100
  Re: logcheck(1) in bookworm 12.5  /etc/logcheck/logcheck.logfiles.d/syslog.logfiles Andy Smith <andy@strugglers.net> - 2024-03-14 23:00 +0100
  Re: logcheck(1) in bookworm 12.5  /etc/logcheck/logcheck.logfiles.d/syslog.logfiles Charles Curley <charlescurley@charlescurley.com> - 2024-03-14 23:20 +0100
    Re: logcheck(1) in bookworm 12.5  /etc/logcheck/logcheck.logfiles.d/syslog.logfiles Andy Smith <andy@strugglers.net> - 2024-03-14 23:40 +0100

csiph-web