To make syslog send logs to the log host, put
To get syslog to accept remote logs, you need to edit /etc/init.d/sysklogd.
Some newer installs have rsyslogd rather than syslog. This causes problems when sending logs to an external syslog that doesn't handle the hostnames properly (see rsyslogd's README.Debian for details), so instead put
$template sysklogd,"<%PRI%>%TIMESTAMP% %syslogtag%%msg%" *.* @loghost;sysklogd
To receive hourly log summaries by email, add yourself to the sysmans-logs and root aliases in /etc/aliases on mccoy, and remember to run 'newaliases' when you're done. The altlogs alias was introduced when the piperlog script was first tried out, but now receives the same logs as sysmans-logs.
Ignoring more or less messages
To adjust which messages make it into the log summaries, you can adjust the following files in /etc/piperlog on piper:
|discard||messages you want to see, but logcheck ignores|
|extra||messages you want to ignore in addition to the patterns from logcheck|
|summarise||patterns giving messages which should collapsed into a single message in the summary|
In the summarise patterns the groups (the parts in parentheses) must match. For example, the pattern
^sshd\[[0-9]+\]: Illegal user .+ from (.+)$
in the summarise file makes piperlog report only one failed login attempt from each host regardless of how many usernames are tried because only the host name is in parentheses.
After changing the discard or extra files you should rebuild the ignore file by running the mkignore script. There is also a test script which gives the messages to date which will appear in the next summary email.
The number and timing of the email messages sent out can also be adjusted:
crontab -e -u piperlog