I've setup logcheck on my gentoo system, mostly following: https://wiki.gentoo.org/wiki/Logcheck
It is working fairly well. A typical logcheck email I receive looks like: Security Events for su =-=-=-=-=-=-=-=-=-=-=- Using fallback detection... please install python-magic for better gzip detection. 0 Lines skipped (already processed) 0 Patterns to ignore 0 Ignored lines 1 sempron su: pam_unix(su:session): session opened for user man(uid=13) by (uid=0) 1 sempron su: pam_unix(su:session): session opened for user root(uid=0) by tom(uid=1000) 1 sempron su: pam_unix(su:session): session opened for user logcheck(uid=997) by (uid=0) Noticed the line "Using fallback detection... please install python-magic for better gzip detection." I installed python-magic, but that makes no difference. The line is always there, and it appears in both the "Security Events" and "System Events" part of the email. Anybody have any idea how to get rid of it? Tom Naujokas (elu6-u259 at spamex.com)
