[Logwatch] Log entries for ppp dialin

Kirk Bauer kirk@kaybee.org
Fri, 11 Oct 2002 15:04:36 -0400 (EDT)


On Mon, 29 Jul 2002, Andrea Wachter wrote:

> Does anybody have a logwatch script which parses the /var/log/messages file for 
> entries of pppd login ?
> 
> We consider these messages important because it's a form of remote access to 
> the server and we would like to see whether there were a lot of unsuccessful 
> authentication attempts or attempts from unusual users...
> So we would like them to show up in our logwatch reports.

I think a pppd filter would be a valuable addition, but I don't have
time to write new filters... I have enough trouble keeping up with
patches ;)

If somebody writes one, please be sure to send it to me.

-- 
 Kirk Bauer -- CmpE, Georgia Tech -- kirk@kaybee.org -- Avid Linux User
     http://linux.kaybee.org | www.autorpm.org | www.logwatch.org
    Opinions expressed are my own, but they should be everybody's.