[cobalt-security] Logcheck & Crontab

["Render-Vue" <sales@xxxxxxxxxxxxxx>]

Hi Yah,

Can anyone tell me why our RAQ3's automatic monitoring services should have
stopped showing on logchecks reports?

Over the last 24 hours my logcheck reports have stopped showing the usual
activity. I've just checked the crontab (see below) and the monitoring is
still there.

I've called /usr/local/sbin/swatch >>/var/cobalt/adm.log 2>&1 manually from
the root command then run the lockcheck script /usr/local/etc/logcheck.sh
and it reports the monitoring as normal.

So I'm a bit confused as to why it's now not showing in logcheck
automatically.

Logcheck is run from the etc/cron.hourly, crontab & logcheck haven't been
touched or modified

crontab...
SHELL=/bin/bash
PATH=/sbin:/bin:/usr/sbin:/usr/bin
MAILTO=root
HOME=/

# run-parts
03,18,33,48 * * * * root run-parts /etc/cron.quarter-hourly
04,34 * * * * root run-parts /etc/cron.half-hourly
01 * * * * root run-parts /etc/cron.hourly
05 0,6,12,18 * * * root run-parts /etc/cron.quarter-daily
02 4 * * * root run-parts /etc/cron.daily
22 4 * * 0 root run-parts /etc/cron.weekly
42 4 1 * * root run-parts /etc/cron.monthly

# Monitor services to make sure everything is still okay.
0,15,30,45 * * * * root /usr/local/sbin/swatch >>/var/cobalt/adm.log 2>&1

logcheck...
#Hourly check using logcheck
/usr/local/etc/logcheck.sh


Regards from Auckland

Chae