Re: Log file IDS package?

On Wed, 2005-01-12 at 16:57 +1100, Andrew Pollock wrote: > Hi, > > I've done some cursory apt-cache searching, and nothing's jumped out at > me... > > Is there software in Debian that will do something along the lines of a tail > -f of a given logfile, looking for supplied regexs and do custom ac

Re: Log file IDS package?

On Wed, Jan 12, 2005 at 04:57:41PM +1100, Andrew Pollock wrote: > Hi, > > I've done some cursory apt-cache searching, and nothing's jumped out at > me... Have you read this? http://www.debian.org/doc/manuals/securing-debian-howto/ch4.en.html#s-log-alerts Logcheck is more or less the standard way

Re: Log file IDS package?

On Wednesday, 2005-01-12 at 16:57:41 +1100, Andrew Pollock wrote: > Is there software in Debian that will do something along the lines of a tail > -f of a given logfile, looking for supplied regexs and do custom actions on > matches? I'm using swatch. But swatch can only limit the number of actio

Log file IDS package?

Hi, I've done some cursory apt-cache searching, and nothing's jumped out at me... Is there software in Debian that will do something along the lines of a tail -f of a given logfile, looking for supplied regexs and do custom actions on matches? I want to tarpit excessive SSH login failures. rega