Inhaltsverzeichnis

Reguläre Ausdrücke für Logcheck für Murmur (Mumble-Server)

This is a regex file for logcheck. Partially taken from multitail-theme.

Hosted on GitHub with other logcheck rule files: https://github.com/Natenom/logcheck-rule-files.

Installation

If using the original Mumble server logfile

Put this file into /etc/logcheck/ignore.d.server and add the murmur.log path to /etc/logcheck.logfiles.

Make sure logcheck can access the servers log file.

To test what will be sent via mail, use:

logcheck-test -i -l /path/to/murmur.log -r /etc/logcheck/ignore.d.server/murmur

To invoke logcheck manually:

su -s /bin/bash -c "/usr/sbin/logcheck" logcheck

If the Mumble server logs to syslog daemon

Put this file into /etc/logcheck/ignore.d.server.

To test what will be sent via mail, use:

logcheck-test -i -l /var/log/syslog -r /etc/logcheck/ignore.d.server/murmur_syslog

To invoke logcheck manually:

su -s /bin/bash -c "/usr/sbin/logcheck" logcheck

Result

The following events are sent via email:

Ice - Schnittstelle zum Mumble-Server stuff
Logins without correct certificate or logins with wrong password
Global ban
Server ban
Certificate hash ban
Banlist update
Invalid username

Example

<W>2012-11-11 16:57:18.047 1 => Ice ServerCallback ABABABABAB-CCDD-EDEDE-BABA-9182ADFADADAD -o:tcp -h 127.0.0.1 -p 49621 failed
<W>2012-11-11 16:57:18.048 1 => Removed Ice ServerCallback ABABABABAB-CCDD-EDEDE-BABA-9182ADFADADAD -o:tcp -h 127.0.0.1 -p 49621
<W>2012-11-11 16:57:31.306 Added Ice MetaCallback ABABABABAB-CCDD-EDEDE-BABA-9182ADFADADAD -o:tcp -h 127.0.0.1 -p 46513 -t 5000
<W>2012-11-11 17:30:43.472 1 => <91:Username(-1)> Rejected connection: Wrong certificate or password for existing user

logcheck, logs, logfile, check