Debian Logcheck: Scan System Logs for Security Anomalies

Logcheck is an automated log analysis utility designed to help system administrators detect security violations and unusual system activity on Debian systems. Operating as a host-based monitoring tool, it periodically scans system log files, filters out standard, routine operational messages using regular expressions, and delivers a concise summary of anomalies, potential intrusions, and system events directly to the administrator via email.

Core Architecture and Detection Mechanism

Logcheck functions primarily by elimination. Instead of requiring users to define every possible security threat, it maintains a comprehensive baseline of normal system activity. During a scan, Logcheck parses through target log files (such as /var/log/syslog and /var/log/auth.log) and systematically filters out expected log entries using categorized regular expressions. Any entry that is not explicitly marked as normal or benign is flagged as an anomaly and compiled into an alert report.

Log Filtering Hierarchy

On a Debian system, Logcheck categorizes events and rules within /etc/logcheck/ into distinct levels of scrutiny:

  • Cracking (cracking.d): Contains rules designed to detect active attacks and serious compromises, such as rootkits, buffer overflows, or known exploit payloads. Entries matching these rules are immediately prioritized.
  • Violations (violations.d): Captures unauthorized attempts and security rule breaks, such as failed authentication attempts, unauthorized sudo executions, or invalid SSH logins.
  • Violations Ignore (violations.ignore.d): Overrides violation warnings for specific, trusted operations that would otherwise trigger a false positive.
  • Ignore (ignore.d.*): Filters out standard system noise generated by healthy services (such as cron jobs, network interfaces renewing DHCP leases, or normal daemon heartbeats).

Debian allows administrators to set the filtering strictness via three predefined profiles: workstation (filters the most noise), server (balanced for production environments), and paranoid (extremely strict, reporting almost all non-trivial log lines).

Automation and Reporting in Debian

Logcheck integrates natively with Debian’s scheduling and mail subsystems:

  • Cron Execution: Installed under a dedicated unprivileged user (logcheck), the service uses a cron job situated in /etc/cron.d/logcheck to run hourly by default, as well as upon system reboots.
  • Log Offset Tracking: Logcheck employs logtail, a helper utility that records the exact byte position read in each monitored log file. This ensures that subsequent runs only process newly appended data, preventing duplicate alerts.
  • MTA Integration: Once log parsing is complete, Logcheck compiles any unignored lines into an email sent to the local root account or a specified administrative address through an installed Mail Transfer Agent (MTA) such as Postfix or Exim.

Security Anomalies Detected

In an operational Debian environment, Logcheck is particularly effective at uncovering:

  • Authentication Abuse: Repeated failed password attempts against SSH, FTP, or local terminal sessions indicating brute-force or dictionary attacks.
  • Privilege Escalation: Sudo failures, unauthorized attempts to switch to the root user via su, or execution of commands restricted by policy.
  • Service Failures and Restarts: Daemons crashing unexpectedly, memory allocation errors, or kernel panic indicators that could signify denial-of-service (DoS) attempts or hardware degradation.
  • Port Scans and Firewall Drops: Incoming connection requests blocked by netfilter/iptables rules configured to log dropped packets.