[Logwatch] (no subject)
mgt at stellarcore.net
Sun Oct 14 08:40:22 MST 2007
Thomas Hillson wrote:
> How can I change my logwatch configuration to include the IP Number
> of the system trying to attack my server? I am specifically trying to
> get more information on what Mod_security is putting into my httpd
> log file on RHEL 4 and 5 systems. I get the event but I would like
> the IP Numbers so I can track multiple attacks from the same machine
> and attacks that may be local.
Not 100% sure I understand but... Logwatch has an option called
--numeric that keeps IP's.
More information about the Logwatch