Logcheck (Port Sentry) problem

Thread Tools Search this Thread
Operating Systems Solaris Logcheck (Port Sentry) problem
# 1  
Old 01-21-2008
Logcheck (Port Sentry) problem


Logcheck is installed on a Solaris sparc machine running Solaris 10. It (Logcheck) is being driven by a scheduled cron job and it works as it is supposed to.

However, I am having a problem getting it to work whenever I try to add a rule to the /usr/local/etc/logcheck.violations file in order to cause the Logcheck application to send an alert whenever an ssh login attempt failure occurs.

As of this writing, I have done the following:

(1) Made necessary entries in the /etc/syslog.conf to insure that ssh logging is occuring. This has been verified.

(2) The cron job which instigates the Logcheck application is running normally. This has been verified.

(3) I edited the /usr/local/etc/logcheck.sh script to look like this:

# SunOS, Sun Solaris 2.5
$LOGTAIL /var/log/syslog > $TMPDIR/check.$$
$LOGTAIL /var/adm/messages >> $TMPDIR/check.$$
#$LOGTAIL /var/adm/auth >> $TMPDIR/check.$$
$LOGTAIL /var/log/ssh.log >> $TMPDIR/check.$$

(4) I have installed the following line in the /usr/local/etc/logcheck.violations file:
"authentication failed" (minus the quotes, of course!)

The "authentication failed" line was added to cause the logcheck script to alert on any failed ssh login attempts because the ssh.log file reports, in part "Authentication failed".

(5) When I try to test Logcheck to send an alert by purposefully failing an ssh login attempt, the failed login attempt is reported in
/var/log/ssh.log but the Logcheck application fails to send an e-mail message alert to the sysadmin.

Any ideas as to what I need to do to correct this problem so that Logcheck will report the failed ssh login attempt?

Andy and all responses are very much appreciated! Thanks ahead of time!

Rob Sandifer
Login or Register to Ask a Question

Previous Thread | Next Thread

9 More Discussions You Might Find Interesting

1. Debian

Logcheck sending emails everywhere

Hi, I just recently installed logcheck running it at defaults. I don't have a /home/logcheck, even though the logcheck.conf MAILTO variable says "logcheck". Now I have a .forward in my regular home /home/awayand which gets an hourly report from logcheck but I have no clue how to turn that off. I... (0 Replies)
Discussion started by: awayand
0 Replies

2. Solaris

How to find port number wwn of particular port on dual port HBA,?

please find the below o/p for your reference bash-3.00# fcinfo hba-port HBA Port WWN: 21000024ff295a34 OS Device Name: /dev/cfg/c2 Manufacturer: QLogic Corp. Model: 375-3356-02 Firmware Version: 05.03.02 FCode/BIOS Version: BIOS: 2.02; fcode: 2.01;... (3 Replies)
Discussion started by: sb200
3 Replies

3. Shell Programming and Scripting

Monitor log entries in log files with no Date format? - Efficient logcheck?

is there a way to efficiently monitor logfiles that do not have a date or time format? i have several logs on several different servers that need to be monitored. but i realized writing a script for this would be very complex and time consuming giving the variety of things i need to check for i.e.... (2 Replies)
Discussion started by: SkySmart
2 Replies

4. Solaris

Reinstall Hardware sentry

Hi Guys, I need to reinstall hardware sentry for BMC patrol manager in solariws server. I am trying to find the patrol version. please help me with the version number and reinstallation as i am new. Uname -a:SunOS 5.10 Generic_142901-06 i86pc i386 i86pc Thanks in advance!!! (0 Replies)
Discussion started by: Rockyc3400
0 Replies

5. Solaris

Serial port problem

I am working with solaris 9 sparc and I want to connect physical device in serial port but when I am connecting it,It is showing the error window saying-- So can any1 tell me the reason or is there any package I have to add to work with serial port??? (2 Replies)
Discussion started by: smartgupta
2 Replies

6. UNIX for Dummies Questions & Answers

problem with serial port BSD

Hello all , i have change my system debian linux to freebsd( pcBSD) all working as well , but the serial does not work correctly. Under linux the problem does not appears. my problem is than my serial port does work . the first step than i have make is look with dmesg if my serial are... (0 Replies)
Discussion started by: pitbac23
0 Replies

7. Programming

Problem regarding serial port and multithreading

hello, I am creating a application in which I first open the serial port and then create the thread..for reading the data comming through that serial port. from that same thread I create another thread that is write thread means for writing on the serial port... I am continously polling again... (3 Replies)
Discussion started by: arunchaudhary19
3 Replies

8. AIX

Problem opening port 9998

Hi there, I have been trying to open port 9998 on an AIX 5.1 box to no avail. This machine is not connected to the internet and I have only been accessing it locally, so I know it's not a network firewall/proxy issue. I have tried editing /etc/services and inetd.conf, refreshing inetd.conf, and... (3 Replies)
Discussion started by: erica057
3 Replies

9. IP Networking

tcp problem with port

I am trying to connect via DBACCESS and Informix server to a server on a different computer. When I execute the connect command from dbaccess I get the following message, Exec format error cannot bind a name to the port. As far as I know the port is not being used by another client. How... (1 Reply)
Discussion started by: lopez
1 Replies
Login or Register to Ask a Question