RE: [cobalt-security] Logcheck & Crontab

["FLHQ" <fultonlyons@xxxxxxxxxxxxxx>]

Did you (or someone) add "Active_Monitor_69" to violations.ignore?

Send a bit of what you LogCheck used to show.

~Spanky

> -----Original Message-----
> From: cobalt-security-admin@xxxxxxxxxxxxxxx
> [mailto:cobalt-security-admin@xxxxxxxxxxxxxxx]On Behalf Of Render-Vue
> Sent: Tuesday, October 16, 2001 1:45 PM
> To: cobalt-security@xxxxxxxxxxxxxxx
> Subject: [cobalt-security] Logcheck & Crontab
> 
> 
> Hi Yah,
> 
> Can anyone tell me why our RAQ3's automatic monitoring 
> services should have
> stopped showing on logchecks reports?
> 
> Over the last 24 hours my logcheck reports have stopped 
> showing the usual
> activity. I've just checked the crontab (see below) and the 
> monitoring is
> still there.
> 
> I've called /usr/local/sbin/swatch >>/var/cobalt/adm.log 2>&1 
> manually from
> the root command then run the lockcheck script 
> /usr/local/etc/logcheck.sh
> and it reports the monitoring as normal.
> 
> So I'm a bit confused as to why it's now not showing in logcheck
> automatically.
> 
> Logcheck is run from the etc/cron.hourly, crontab & logcheck 
> haven't been
> touched or modified
> 
> crontab...
> SHELL=/bin/bash
> PATH=/sbin:/bin:/usr/sbin:/usr/bin
> MAILTO=root
> HOME=/
> 
> # run-parts
> 03,18,33,48 * * * * root run-parts /etc/cron.quarter-hourly
> 04,34 * * * * root run-parts /etc/cron.half-hourly
> 01 * * * * root run-parts /etc/cron.hourly
> 05 0,6,12,18 * * * root run-parts /etc/cron.quarter-daily
> 02 4 * * * root run-parts /etc/cron.daily
> 22 4 * * 0 root run-parts /etc/cron.weekly
> 42 4 1 * * root run-parts /etc/cron.monthly
> 
> # Monitor services to make sure everything is still okay.
> 0,15,30,45 * * * * root /usr/local/sbin/swatch 
> >>/var/cobalt/adm.log 2>&1
> 
> logcheck...
> #Hourly check using logcheck
> /usr/local/etc/logcheck.sh
> 
> 
> Regards from Auckland
> 
> Chae
> 
> _______________________________________________
> cobalt-security mailing list
> cobalt-security@xxxxxxxxxxxxxxx
> http://list.cobalt.com/mailman/listinfo/cobalt-security