Logcheck(8)

💖 logcheck — the manual page, but make it make sense 💖

okay bestie, welcome to logcheck(8) from the System Manager's Manual. yes it's section 8, yes that means it's a sysadmin thing, and yes you're gonna slay it. let's go 🫶

---

✨ NAME ✨

logcheck — the program that scans your system logs for the interesting lines, so you don't have to sit there reading every single one like it's a group chat you got added to by accident 💅

---

✨ SYNOPSIS ✨

logcheck [OPTIONS]

---

🌸 DESCRIPTION 🌸

so. the logcheck program? it helps you spot problems and security violations in your logfiles, automatically, and then it e-mails you the results periodically. main character behaviour, honestly. by default logcheck runs as an hourly cronjob just off the hour and after every reboot. no cap. 🕐✨

logcheck supports three levels of filtering:

• "paranoid" — for high-security machines running as few services as possible. ⚠️ do NOT use this if you can't handle its verbose messages, like genuinely, it will talk a LOT.
• "server" — this is the default, and it contains rules for many different daemons. 👑
• "workstation" — for sheltered machines, and it filters most of the messages. cozy vibes.

the way the ignore rules work is additive: "paranoid" rules are also included at level "server", and the "workstation" level includes both "paranoid" and "server" rules. so it's like a stacking situation. every level is bringing the previous levels' whole energy. 🧚

the messages reported get sorted into three layers:

1. system events
2. security events
3. attack alerts

the verbosity of system events is controlled by which level you choose — paranoid, server or workstation. BUT — and this is important — security events and attack alerts are not affected by this. they don't care what level you picked, they're showing up regardless. 💀

---

🌈 EXAMPLES 🌈

logcheck can be invoked directly thanks to su(8) or sudo(8), which change the user ID. iconic.

the following example checks the logfiles without updating the offset and outputs everything to STDOUT:

sudo -u logcheck logcheck -o -t

---

💅 OPTIONS 💅

a summary of options is included below, and bestie, we are going through every single one. periodt.

• -c CFG — overrule default configuration file.
• -d — debug mode. 🐛
• -h — show usage information.
• -H — use this hostname string in the subject of logcheck mail.
• -l LOG — run logfile through logcheck.
• -L CFG — overrule default logfiles list.
• -D DIR — overrule default logfiles lists directory.
• -m MAIL — mail report to recipient. 📧
• -o — STDOUT mode, not sending mail.
• -p — set the report level to "paranoid". brave of you honestly.
• -r DIR — overrule default rules directory.
• -R — adds "Reboot:" to the email subject line.
• -s — set the report level to "server".
• -S DIR — overrule default state directory.
• -t — testing mode does not update offset. 🙈
• -T — do not remove the TMPDIR.
• -u — enable syslog-summary.
• -v — print current version.
• -w — set the report level to "workstation".

---

🎀 FILES 🎀

• /etc/logcheck/logcheck.conf is the main configuration file. ✨
• /etc/logcheck/logcheck.logfiles is the list of files to monitor.
• /etc/logcheck/logcheck.logfiles.d is the directory of lists of files to monitor.
• /usr/share/doc/logcheck-database/README.logcheck-database.gz for hints on how to write, test and maintain rules. (yes it's gzipped, yes you have to zcat it, iykyk)

---

⭐ EXIT STATUS ⭐

• 0 upon success 🫶
• 1 upon failure 😭

---

👑 SEE ALSO 👑

• logtail(8)

---

💜 AUTHOR 💜

logcheck is developed by Debian logcheck Team at:

https://salsa.debian.org/debian/logcheck

this manual page was written by Jon Middleton. ty king 🫡

---

and that's the whole page bestie, Logcheck(8), from the System Manager's Manual, top to bottom, every option accounted for. go read your logs, drink some water, and remember: -o -t is your friend when you just wanna peek without touching anything. mwah 💖✨