利用Logwatch高效汇总与分析Linux系统安全日志

 CentOS/RHEL安装
sudo yum install logwatch

 Debian/Ubuntu安装
sudo apt install logwatch

 验证服务状态
systemctl status logwatch.timer

 /usr/share/logwatch/default.conf/logwatch.conf
MailTo = admin@yourdomain.com   接收邮箱
MailFrom = logwatch@hostname    发件标识
Detail = High                   报告详细级别
Range = Yesterday               分析时间范围
Service = All                   监控所有服务

 启用失败登录详细统计
FailedLoginDetail = High

 监控root登录行为
TrackSuccessfulRootLogins = Yes

 忽略特定IP段（可选）
IgnoreIP = 192.168.1.

 监控sudo提权行为
$search_string = 'sudo:.session opened'

 检测CRON异常
$cron_errors = 'CRON.(error|failure|warning)'

 在客户端配置
. @192.168.1.100:514

 在服务端修改Logwatch配置
LogDir = /var/log/remote_hosts/

--------------------- SSHD Begin ------------------------
High Failed logins: 
    root: 12 times from 61.177.173.
    admin: 5 times from 45.227.253.
Warning Possible brute force attack detected
---------------------- SSHD End -------------------------

--------------------- Sudo Begin ------------------------
User 'deploy' executed:
    /usr/bin/apt update
    /bin/systemctl restart nginx
---------------------- Sudo End -------------------------