fredrik/logcheck
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

En hel del nya loggrader for debian

Browse Source
This commit is contained in:
fredrik
2017-03-03 19:22:11 +01:00
parent 3aad5b862e
commit 0e1eefbcfd
2 changed files with 175 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
logcheck_debian
View File

@@ -364,7 +364,8 @@
#May 19 14:05:07 nada sshd(pam_google_authenticator)[20232]: Did not receive verification code from user #May 19 14:05:07 nada sshd(pam_google_authenticator)[20232]: Did not receive verification code from user
#May 19 14:05:17 nada sshd(pam_google_authenticator)[20399]: Invalid verification code #May 19 14:05:17 nada sshd(pam_google_authenticator)[20399]: Invalid verification code
#Feb 28 21:45:36 nada sshd(pam_google_authenticator)[26185]: Failed to update secret file "/root/.google_authenticator" #Feb 28 21:45:36 nada sshd(pam_google_authenticator)[26185]: Failed to update secret file "/root/.google_authenticator"
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\(pam_google_authenticator\)\[[[:digit:]]+\]: (Failed to (read|update) \"[/[:alnum:]]+\/.google_authenticator\"|Invalid verification code|Failed to compute location of secret file|Did not receive verification code from user) #Mar 3 12:57:42 nada sshd(pam_google_authenticator)[20838]: Failed to update secret file "/root/.google_authenticator"
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\(pam_google_authenticator\)\[[[:digit:]]+\]: (Failed to (read|update)( secret file)? \"[/[:alnum:]]+\/.google_authenticator\"|Invalid verification code|Failed to compute location of secret file|Did not receive verification code from user)
# Mar 10 11:12:56 nada sshd[26548]: Received disconnect from 94.102.49.198: 3: com.jcraft.jsch.JSchException: Auth fail [preauth] # Mar 10 11:12:56 nada sshd[26548]: Received disconnect from 94.102.49.198: 3: com.jcraft.jsch.JSchException: Auth fail [preauth]
# Apr 7 05:56:43 kvarnen sshd[2034]: error: Received disconnect from 212.83.191.8: 3: com.jcraft.jsch.JSchException: Auth fail [preauth] # Apr 7 05:56:43 kvarnen sshd[2034]: error: Received disconnect from 212.83.191.8: 3: com.jcraft.jsch.JSchException: Auth fail [preauth]

175
testlog
View File

@@ -218,7 +218,6 @@ Aug 23 06:06:16 nada suhosin[4003]: ALERT - configured GET variable value length
Oct 13 08:31:17 kvarnen systemd[1]: Starting Cleanup of Temporary Directories... Oct 13 08:31:17 kvarnen systemd[1]: Starting Cleanup of Temporary Directories...
Oct 13 08:31:17 kvarnen systemd[1]: Started Cleanup of Temporary Directories. Oct 13 08:31:17 kvarnen systemd[1]: Started Cleanup of Temporary Directories.
Aug 23 18:39:24 nada saslauthd[1713]: do_request : NULL login received Aug 23 18:39:24 nada saslauthd[1713]: do_request : NULL login received
Aug 23 18:39:24 nada fredrik[1713]: Sista raden ska inte synas
Oct 24 06:04:11 nada sm-mta[7813]: STARTTLS=client, error: connect failed=-1, SSL_error=1, errno=0, retry=-1 Oct 24 06:04:11 nada sm-mta[7813]: STARTTLS=client, error: connect failed=-1, SSL_error=1, errno=0, retry=-1
Oct 24 06:04:11 nada sm-mta[7813]: STARTTLS=client: 7813:error:1407741A:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert decode error:s23_clnt.c:757: Oct 24 06:04:11 nada sm-mta[7813]: STARTTLS=client: 7813:error:1407741A:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert decode error:s23_clnt.c:757:
Oct 24 06:04:11 nada sm-mta[7813]: ruleset=tls_server, arg1=SOFTWARE, relay=mail.adlibris.com, reject=403 4.7.0 TLS handshake failed. Oct 24 06:04:11 nada sm-mta[7813]: ruleset=tls_server, arg1=SOFTWARE, relay=mail.adlibris.com, reject=403 4.7.0 TLS handshake failed.
@@ -237,4 +236,176 @@ Mar 1 09:28:40 nada sshd[4919]: Postponed keyboard-interactive/pam for root fro
Mar 1 09:28:43 nada sshd[4919]: Postponed keyboard-interactive/pam for root from 218.65.30.43 port 23516 ssh2 [preauth] Mar 1 09:28:43 nada sshd[4919]: Postponed keyboard-interactive/pam for root from 218.65.30.43 port 23516 ssh2 [preauth]
Mar 1 09:29:01 nada sshd[4939]: Postponed keyboard-interactive/pam for root from 218.65.30.43 port 58713 ssh2 [preauth] Mar 1 09:29:01 nada sshd[4939]: Postponed keyboard-interactive/pam for root from 218.65.30.43 port 58713 ssh2 [preauth]
Mar 1 03:03:26 nada sshd[28313]: fatal: Write failed: Broken pipe [preauth] Mar 1 03:03:26 nada sshd[28313]: fatal: Write failed: Broken pipe [preauth]
Mar 2 07:21:44 nada spamc[16024]: connect to spamd on 127.0.0.1 failed, retrying (#1 of 3): Connection refused Mar 2 07:21:44 nada spamc[16024]: connect to spamd on 127.0.0.1 failed, retrying (#1 of 3): Connection refused
Mar 2 14:16:53 marconi sshd[4282]: Connection closed by 163.172.210.106 port 56708 [preauth]
Mar 2 13:42:26 marconi sshd[25003]: Received disconnect from 155.4.131.66 port 2983:11: disconnected by user
Mar 2 13:42:26 marconi sshd[25003]: Disconnected from 155.4.131.66 port 2983
Aug 23 18:39:24 nada fredrik[1713]: Sista raden ska inte synas
Mar 2 17:16:35 marconi systemd-logind[1241]: New session 85612 of user fredrik.
Mar 2 17:16:35 marconi systemd-logind[1241]: Removed session 85603.
Mar 2 16:25:24 marconi dhclient[22777]: bound to 192.168.1.118 -- renewal in 30618 seconds.
Mar 2 17:00:04 marconi sshd[31419]: Received disconnect from 116.31.116.18 port 20137:11: [preauth]
Mar 2 13:32:26 marconi sshd[21878]: Received disconnect from 155.4.131.66 port 2982:11: disconnected by user
Mar 2 13:26:35 marconi sshd[22990]: Accepted publickey for fredrik from 155.4.131.66 port 2984 ssh2: RSA SHA256:nN4hIQerkj/cftGXDuAmeiduRLomIKBSxT0ssoPTysc
Mar 2 14:05:55 marconi sshd[1776]: Disconnected from 116.31.116.18 port 61532 [preauth]
Mar 2 14:16:35 marconi sshd[1828]: Disconnected from 155.4.131.66 port 2982
Mar 2 17:04:13 marconi sshd[1368]: Disconnecting: Too many authentication failures [preauth]
Mar 2 13:25:14 marconi smartd[17895]: Device: /dev/sdc [SAT], 1 Currently unreadable (pending) sectors
Mar 2 13:25:14 marconi smartd[17895]: Device: /dev/sdc [SAT], 1 Offline uncorrectable sectors
Mar 2 13:25:14 marconi smartd[17895]: Device: /dev/sdc [SAT], Failed SMART usage Attribute: 184 End-to-End_Error.
Mar 2 16:25:24 marconi dhclient[22777]: DHCPACK of 192.168.1.118 from 192.168.1.1
Mar 2 16:25:24 marconi dhclient[22777]: DHCPREQUEST of 192.168.1.118 on enp4s0 to 192.168.1.1 port 67 (xid=0x74f7120)
Mar 2 17:00:24 marconi sshd[556]: Connection reset by 119.147.115.37 port 1841 [preauth]
Mar 2 14:07:17 marconi sshd[1863]: Received disconnect from 116.31.116.18 port 60507:11: [preauth]
Mar 2 14:16:35 marconi sshd[1828]: Received disconnect from 155.4.131.66 port 2982:11: disconnected by user
Mar 2 14:06:35 marconi sshd[1797]: Accepted publickey for fredrik from 155.4.131.66 port 2982 ssh2: RSA SHA256:nN4hIQerkj/cftGXDuAmeiduRLomIKBSxT0ssoPTysc
Mar 2 14:12:26 marconi sshd[679]: Received disconnect from 155.4.131.66 port 2983:11: disconnected by user
Mar 2 14:16:51 marconi sshd[4277]: Connection closed by 163.172.210.106 port 14388 [preauth]
Mar 2 17:07:35 marconi sshd[2635]: Connection reset by 119.147.115.37 port 1070 [preauth]
Mar 2 16:26:52 marconi sshd[22218]: Connection reset by 119.147.115.37 port 4993 [preauth]
Mar 2 14:12:26 marconi sshd[679]: Disconnected from 155.4.131.66 port 2983
Mar 2 17:04:13 marconi sshd[1368]: error: maximum authentication attempts exceeded for root from 39.173.242.89 port 61397 ssh2 [preauth]
Mar 2 14:02:26 marconi sshd[648]: Accepted publickey for fredrik from 155.4.131.66 port 2983 ssh2: RSA SHA256:nN4hIQerkj/cftGXDuAmeiduRLomIKBSxT0ssoPTysc
Mar 2 16:25:24 marconi nm-dispatcher: req:1 'dhcp4-change' [enp4s0]: new request (1 scripts)
Mar 2 16:25:24 marconi nm-dispatcher: req:1 'dhcp4-change' [enp4s0]: start running ordered scripts...
Mar 2 13:31:22 marconi sshd[24935]: error: maximum authentication attempts exceeded for root from 14.155.151.175 port 49156 ssh2 [preauth]
Mar 2 13:23:45 marconi systemd[1]: Started CUPS Scheduler.
Mar 2 16:25:24 marconi systemd[1]: Started Network Manager Script Dispatcher Service.
Mar 2 17:16:35 marconi systemd[1]: Started Session 85612 of user fredrik.
Mar 2 16:25:24 marconi systemd[1]: Starting Network Manager Script Dispatcher Service...
Mar 2 13:32:26 marconi sshd[21878]: Disconnected from 155.4.131.66 port 2982
Mar 2 13:31:22 marconi sshd[24935]: Disconnecting: Too many authentication failures [preauth]
Mar 2 16:25:24 marconi dbus[1185]: [system] Activating via systemd: service name='org.freedesktop.nm_dispatcher' unit='dbus-org.freedesktop.nm-dispatcher.service'
Mar 2 16:25:24 marconi dbus[1185]: [system] Successfully activated service 'org.freedesktop.nm_dispatcher'
Mar 2 16:48:02 marconi telldusd: Execute a TellStick Action for device 1
Mar 2 16:49:02 marconi telldusd: Execute a TellStick Action for device 2
Mar 2 16:48:02 marconi telldusd: Execute a TellStick Action for device 3
Mar 2 20:18:14 marconi sshd[31811]: Received disconnect from 72.167.13.11 port 32867:11: Bye Bye [preauth]
Mar 2 20:33:25 marconi sshd[3723]: fatal: Unable to negotiate with 103.207.39.105 port 59502: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth]
Mar 2 20:51:23 marconi sshd[8330]: error: maximum authentication attempts exceeded for invalid user admin from 182.45.153.221 port 54407 ssh2 [preauth]
Feb 27 16:18:14 marconi sshd[30894]: Accepted publickey for fredrik from 213.153.113.136 port 60681 ssh2: RSA SHA256:wtbGEMuojY+6IMUyU8t0rkg4bZoxeb07q1PqctZODzQ
Feb 27 18:16:55 marconi sshd[30123]: fatal: mm_answer_moduli: bad parameters: 2048 2048 1024
Feb 28 03:15:06 marconi sshd[9243]: Accepted publickey for root from 66.23.226.92 port 35645 ssh2: RSA SHA256:Z0G8XQQjwahIdAJmj/DA0j29v+zA2v17C4b0rvOV6Nw
Feb 28 03:17:11 marconi systemd: pam_unix(systemd-user:session): session opened for user root by (uid=0)
Feb 28 03:17:18 marconi systemd: pam_unix(systemd-user:session): session closed for user root
Mar 2 22:01:02 marconi systemd[1]: Starting Daily apt activities...
Mar 2 22:01:04 marconi systemd[1]: Started Daily apt activities.
Mar 2 22:01:04 marconi systemd[1]: apt-daily.timer: Adding 6h 5min 38.342426s random time.
Mar 2 22:01:04 marconi systemd[1]: apt-daily.timer: Adding 6h 2min 20.962257s random time.
Mar 3 06:21:50 marconi named[27570]: client 106.185.43.131#50963: message parsing failed: unexpected end of input
Mar 3 07:30:02 marconi systemd[1]: Started Run anacron jobs.
Mar 3 07:36:04 marconi systemd[1]: Reloading The Apache HTTP Server.
Mar 3 07:36:06 marconi systemd[1]: Reloaded The Apache HTTP Server.
Mar 3 07:36:06 marconi systemd[1]: Stopping Make remote CUPS printers available locally...
Mar 3 07:36:06 marconi systemd[1]: Stopped Make remote CUPS printers available locally.
Mar 3 07:36:06 marconi systemd[1]: Stopping CUPS Scheduler...
Mar 3 07:36:06 marconi systemd[1]: Stopped CUPS Scheduler.
Mar 3 07:36:07 marconi systemd[1]: Started Make remote CUPS printers available locally.
Mar 3 03:15:04 marconi systemd[1]: Created slice User Slice of root.
Mar 3 03:15:04 marconi systemd[1]: Starting User Manager for UID 0...
Mar 3 03:15:06 marconi systemd[17958]: Reached target Paths.
Mar 3 03:15:06 marconi systemd[17958]: Reached target Timers.
Mar 3 03:15:06 marconi systemd[17958]: Reached target Sockets.
Mar 3 03:15:06 marconi systemd[17958]: Reached target Basic System.
Mar 3 03:15:06 marconi systemd[17958]: Reached target Default.
Mar 3 03:15:06 marconi systemd[17958]: Startup finished in 665ms.
Mar 3 03:15:06 marconi systemd[1]: Started User Manager for UID 0.
Mar 3 03:15:07 marconi systemd[1]: Stopping User Manager for UID 0...
Mar 3 03:15:07 marconi systemd[17958]: Reached target Shutdown.
Mar 3 03:15:07 marconi systemd[17958]: Starting Exit the Session...
Mar 3 03:15:07 marconi systemd[17958]: Stopped target Default.
Mar 3 03:15:07 marconi systemd[17958]: Stopped target Basic System.
Mar 3 03:15:07 marconi systemd[17958]: Stopped target Timers.
Mar 3 03:15:07 marconi systemd[17958]: Stopped target Sockets.
Mar 3 03:15:07 marconi systemd[17958]: Stopped target Paths.
Mar 3 03:15:07 marconi systemd[17958]: Received SIGRTMIN+24 from PID 18190 (kill).
Mar 3 03:15:07 marconi systemd[1]: Stopped User Manager for UID 0.
Mar 3 03:15:07 marconi systemd[1]: Removed slice User Slice of root.
Mar 3 03:15:08 marconi systemd[1]: Created slice User Slice of root.
Mar 3 03:15:08 marconi systemd[1]: Starting User Manager for UID 0...
Mar 3 03:15:09 marconi systemd[18209]: Reached target Paths.
Mar 3 03:15:09 marconi systemd[18209]: Reached target Timers.
Mar 3 03:15:09 marconi systemd[18209]: Reached target Sockets.
Mar 3 03:15:09 marconi systemd[18209]: Reached target Basic System.
Mar 3 03:15:09 marconi systemd[18209]: Reached target Default.
Mar 3 03:15:09 marconi systemd[18209]: Startup finished in 124ms.
Mar 3 03:15:09 marconi systemd[1]: Started User Manager for UID 0.
Mar 3 03:17:28 marconi systemd[1]: Stopping User Manager for UID 0...
Mar 3 03:17:28 marconi systemd[18209]: Reached target Shutdown.
Mar 3 03:17:28 marconi systemd[18209]: Starting Exit the Session...
Mar 3 03:17:28 marconi systemd[18209]: Stopped target Default.
Mar 3 03:17:28 marconi systemd[18209]: Stopped target Basic System.
Mar 3 03:17:28 marconi systemd[18209]: Stopped target Paths.
Mar 3 03:17:28 marconi systemd[18209]: Stopped target Sockets.
Mar 3 03:17:28 marconi systemd[18209]: Stopped target Timers.
Mar 3 03:17:29 marconi systemd[18209]: Received SIGRTMIN+24 from PID 19176 (kill).
Mar 3 03:17:29 marconi systemd[1]: Stopped User Manager for UID 0.
Mar 3 03:17:29 marconi systemd[1]: Removed slice User Slice of root.
Mar 3 03:17:29 marconi systemd[1]: Created slice User Slice of root.
Mar 3 03:17:29 marconi systemd[1]: Starting User Manager for UID 0...
Mar 3 03:17:30 marconi systemd[19182]: Reached target Paths.
Mar 3 03:17:30 marconi systemd[19182]: Reached target Timers.
Mar 3 03:17:30 marconi systemd[19182]: Reached target Sockets.
Mar 3 03:17:30 marconi systemd[19182]: Reached target Basic System.
Mar 3 03:17:30 marconi systemd[19182]: Reached target Default.
Mar 3 03:17:30 marconi systemd[19182]: Startup finished in 526ms.
Mar 3 03:17:30 marconi systemd[1]: Started User Manager for UID 0.
Mar 3 03:17:42 marconi systemd[1]: Stopping User Manager for UID 0...
Mar 3 03:17:42 marconi systemd[19182]: Reached target Shutdown.
Mar 3 03:17:42 marconi systemd[19182]: Stopped target Default.
Mar 3 03:17:42 marconi systemd[19182]: Stopped target Basic System.
Mar 3 03:17:42 marconi systemd[19182]: Stopped target Paths.
Mar 3 03:17:42 marconi systemd[19182]: Stopped target Sockets.
Mar 3 03:17:42 marconi systemd[19182]: Stopped target Timers.
Mar 3 03:17:42 marconi systemd[19182]: Starting Exit the Session...
Mar 3 03:17:42 marconi systemd[19182]: Received SIGRTMIN+24 from PID 19222 (kill).
Mar 3 03:17:42 marconi systemd[1]: Stopped User Manager for UID 0.
Mar 3 03:17:42 marconi systemd[1]: Removed slice User Slice of root.
Mar 3 03:17:43 marconi systemd[1]: Created slice User Slice of root.
Mar 3 03:17:43 marconi systemd[1]: Starting User Manager for UID 0...
Mar 3 03:17:43 marconi systemd[19230]: Reached target Timers.
Mar 3 03:17:43 marconi systemd[19230]: Reached target Sockets.
Mar 3 03:17:43 marconi systemd[19230]: Reached target Paths.
Mar 3 03:17:43 marconi systemd[19230]: Reached target Basic System.
Mar 3 03:17:43 marconi systemd[19230]: Reached target Default.
Mar 3 03:17:43 marconi systemd[19230]: Startup finished in 85ms.
Mar 3 03:17:43 marconi systemd[1]: Started User Manager for UID 0.
Mar 3 03:17:46 marconi systemd[1]: Stopping User Manager for UID 0...
Mar 3 03:17:46 marconi systemd[19230]: Stopped target Default.
Mar 3 03:17:46 marconi systemd[19230]: Reached target Shutdown.
Mar 3 03:17:46 marconi systemd[19230]: Starting Exit the Session...
Mar 3 03:17:46 marconi systemd[19230]: Stopped target Basic System.
Mar 3 03:17:46 marconi systemd[19230]: Stopped target Timers.
Mar 3 03:17:46 marconi systemd[19230]: Stopped target Sockets.
Mar 3 03:17:46 marconi systemd[19230]: Stopped target Paths.
Mar 3 03:17:46 marconi systemd[19230]: Received SIGRTMIN+24 from PID 19268 (kill).
Mar 3 03:17:46 marconi systemd[1]: Stopped User Manager for UID 0.
Mar 3 03:17:46 marconi systemd[1]: Removed slice User Slice of root.
Mar 3 03:17:47 marconi systemd[1]: Created slice User Slice of root.
Mar 3 03:17:47 marconi systemd[1]: Starting User Manager for UID 0...
Mar 3 03:17:48 marconi systemd[19275]: Reached target Sockets.
Mar 3 03:17:48 marconi systemd[19275]: Reached target Paths.
Mar 3 03:17:48 marconi systemd[19275]: Reached target Timers.
Mar 3 03:17:48 marconi systemd[19275]: Reached target Basic System.
Mar 3 03:17:48 marconi systemd[19275]: Reached target Default.
Mar 3 03:17:48 marconi systemd[19275]: Startup finished in 80ms.
Mar 3 03:17:48 marconi systemd[1]: Started User Manager for UID 0.
Mar 3 03:18:09 marconi systemd[1]: Stopping User Manager for UID 0...
Mar 3 03:18:09 marconi systemd[19275]: Stopped target Default.
Mar 3 03:18:09 marconi systemd[19275]: Stopped target Basic System.
Mar 3 03:18:09 marconi systemd[19275]: Stopped target Sockets.
Mar 3 03:18:09 marconi systemd[19275]: Stopped target Paths.
Mar 3 03:18:09 marconi systemd[19275]: Stopped target Timers.
Mar 3 03:18:09 marconi systemd[19275]: Reached target Shutdown.
Mar 3 03:18:09 marconi systemd[19275]: Starting Exit the Session...
Mar 3 03:18:09 marconi systemd[19275]: Received SIGRTMIN+24 from PID 19328 (kill).
Mar 3 03:18:09 marconi systemd[1]: Stopped User Manager for UID 0.
Mar 3 03:18:09 marconi systemd[1]: Removed slice User Slice of root.
Mar 3 00:02:36 marconi BACKUP: Automysqlbackup
Mar 3 00:02:37 marconi BACKUP: Daglig backup klar
Mar 3 00:00:01 marconi BACKUP: Startar daglig backup
Mar 3 00:00:01 marconi BACKUP: Hemkatalogerna
Mar 3 00:01:06 marconi BACKUP: Etc
Mar 3 00:01:09 marconi BACKUP: Prylarna i opt
Mar 3 00:01:26 marconi BACKUP: Webservern
Mar 3 12:57:42 nada sshd(pam_google_authenticator)[20838]: Failed to update secret file "/root/.google_authenticator"