Hi,

You've got Sean Boran's version of logcheck v1.1 (originally by Craig Rowland).
I've hacked and improved to suit my needs, hopefully they suit yours too...

Changes: 
- Many many changes to logcheck.sh, see the history notes in that file.
- Tested on Solaris 8; Suse 8.2, 9.1, Rh9, 
- Include logtail binaries for SPARC and Intel Solaris , and x86 Linux (suse)
- Comments allowed in all rule files.
- Generic logcheck.ignore.gen, put your site customisations in logcheck.ignore
- tidy_syslog.pl filter

Install:
- Create /secure. Extract logcheck.tar into it.
- Edit logcheck.sh and check that variables such as COMPRESS, MAIL, ROTATE
  SSH etc are properly set.
- make sure email can be delivered to root
- configure /secure/secure.conf
- Let it run: /secure/logcheck/logcheck.sh

Tuning:
- Tune logcheck.ignore to get rid of reported entries that don't interest you.
- Read logcheck.sh again. Make sure that all logs you want monitored are included 
there. Consider adding analysis of remote logs via SSH is needed (see example).
- Finally, add entries to Root cron, for example:
0 5    * * 1   /secure/logcheck/logcheck.sh -prune
0 5    * * 2-5 /secure/logcheck/logcheck.sh
0 13   * * 1-5 /secure/logcheck/logcheck.sh

Support: Read all files carefully, distunguish what is from me and what is from Craig.
         Document your problems in detail, then you can email me.

sean@boran.com     http://www.boran.com/security/sp/solaris        23.Aug.04

