journalwatch config

This commit is contained in:
Daniel Langbein 2023-10-03 18:51:34 +02:00
parent f3dbce1f41
commit e0d637cbf8
Signed by: langfingaz
GPG Key ID: 6C47C753F0823002

View File

@ -222,20 +222,6 @@
''; '';
match = "_SYSTEMD_UNIT = systemd-udevd.service"; match = "_SYSTEMD_UNIT = systemd-udevd.service";
} }
{ # yodaYoga
filters = ''
# Somebody evil ...
error: kex_exchange_identification: banner line contains invalid characters
# error: kex_exchange_identification: client sent invalid protocol identifier "MGLNDD_188.194.209.73_2222"
# error: kex_exchange_identification: client sent invalid protocol identifier "GET / HTTP/1.1"
error: kex_exchange_identification: client sent invalid protocol identifier "[^"]+"
error: kex_exchange_identification: Connection closed by remote host
error: kex_exchange_identification: read: Connection reset by peer
error: PAM: Authentication failure for \S+ from \S+
fatal: Timeout before authentication for \S+ port [0-9]+
'';
match = "_SYSTEMD_UNIT = sshd.service";
}
{ # yodaTux, yodaYoga { # yodaTux, yodaYoga
filters = '' filters = ''
The system will suspend now! The system will suspend now!
@ -291,6 +277,20 @@
# SYSLOG_IDENTIFIER # SYSLOG_IDENTIFIER
# #
{ # yodaYoga, yodaNas
filters = ''
# Somebody evil ...
error: kex_exchange_identification: banner line contains invalid characters
# error: kex_exchange_identification: client sent invalid protocol identifier "MGLNDD_188.194.209.73_2222"
# error: kex_exchange_identification: client sent invalid protocol identifier "GET / HTTP/1.1"
error: kex_exchange_identification: client sent invalid protocol identifier "[^"]+"
error: kex_exchange_identification: Connection closed by remote host
error: kex_exchange_identification: read: Connection reset by peer
error: PAM: Authentication failure for \S+ from \S+
fatal: Timeout before authentication for \S+ port [0-9]+
'';
match = "SYSLOG_IDENTIFIER = sshd";
}
{ # yodaTux. If the user `yoda` runs a command with `sudo`. { # yodaTux. If the user `yoda` runs a command with `sudo`.
filters = '' filters = ''
\s+yoda : TTY=pts/[0-9] ; PWD=/\S+ ; USER=root ; COMMAND=/.+ \s+yoda : TTY=pts/[0-9] ; PWD=/\S+ ; USER=root ; COMMAND=/.+