fredrik/logcheck
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Diverse uppdaterade regler

Browse Source
This commit is contained in:
fredrik
2017-03-26 21:22:25 +02:00
parent c287979a0e
commit 9ff928d1d5
3 changed files with 83 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
logcheck_ubuntu
View File

@@ -2,7 +2,7 @@
# BACKUP
#
\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ BACKUP:
\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ backup\[[[:digit:]]+\]
#
# DBUS
@@ -24,7 +24,8 @@
\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dhclient\[[[:digit:]]+\]: DHCPACK of [.:[:digit:]]+ from [.:[:digit:]]+
#Mar 2 16:25:24 marconi dhclient[22777]: DHCPREQUEST of 192.168.1.118 on enp4s0 to 192.168.1.1 port 67 (xid=0x74f7120)
\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dhclient\[[[:digit:]]+\]: DHCPREQUEST of [.:[:digit:]]+ on enp4s0 to [.:[:digit:]]+ port 67 \(xid\=0x74f7120\)
#Mar 25 02:59:08 marconi dhclient[31370]: DHCPREQUEST of 192.168.1.118 on enp4s0 to 192.168.1.1 port 67 (xid=0x3d70f3bb)
\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dhclient\[[[:digit:]]+\]: DHCPREQUEST of [.:[:digit:]]+ on enp4s0 to [.:[:digit:]]+ port 67 \(xid\=[[:alnum:]]+\)
#Mar 2 16:25:24 marconi nm-dispatcher: req:1 'dhcp4-change' [enp4s0]: new request (1 scripts)
\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ nm-dispatcher: req:1 'dhcp4-change' \[enp4s0\]: new request \(1 scripts\)
@@ -32,6 +33,14 @@
#Mar 2 16:25:24 marconi nm-dispatcher: req:1 'dhcp4-change' [enp4s0]: start running ordered scripts...
\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ nm-dispatcher: req:1 'dhcp4-change' \[enp4s0\]: start running ordered scripts...
#Mar 25 05:53:41 marconi dhcpcd[2859]: enp4s0: adding route to 192.168.1.0/24
#Mar 25 05:53:41 marconi dhcpcd[2859]: enp4s0: adding default route via 192.168.1.1
#Mar 25 05:53:41 marconi dhcpcd[2859]: enp4s0: removing default route via 192.168.1.1
\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dhcpcd\[[[:digit:]]+\]: enp4s0: (adding|removing)( default)? route (via|to) 192.168.?.?(\/24)?
#Mar 25 05:53:41 marconi dhcpcd[2859]: if_route (ADD): File exists
\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dhcpcd\[[[:digit:]]+\]: if_route \(ADD\): File exists
@@ -78,7 +87,8 @@
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Received disconnect from [.:[:digit:]]+ port [.:[:digit:]]+:11: Bye Bye \[preauth\]
#Mar 2 20:33:25 marconi sshd[3723]: fatal: Unable to negotiate with 103.207.39.105 port 59502: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth]
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: fatal: Unable to negotiate with [.:[:digit:]]+ port [.:[:digit:]]+: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 \[preauth\]
#Mar 9 05:42:53 marconi sshd[6125]: fatal: Unable to negotiate with 84.241.42.101 port 61319: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1 [preauth]
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: fatal: Unable to negotiate with [.:[:digit:]]+ port [.:[:digit:]]+: no matching key exchange method found. Their offer: [-,[:alnum:]]+ \[preauth\]
#Mar 2 20:51:23 marconi sshd[8330]: error: maximum authentication attempts exceeded for invalid user admin from 182.45.153.221 port 54407 ssh2 [preauth]
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: error: maximum authentication attempts exceeded for invalid user [[:alnum:]]+ from [.:[:digit:]]+ port [.:[:digit:]]+ ssh2 \[preauth\]