I've been happily running Logwatch on several servers with the default 'yesterday' date range for several years. However I needed to run it for a client with a larger date range to check out a problem. But the options available for logwatch are only 'today', 'yesterday' and 'all'. Or so it told me. And even worse, the 'yesterday' option takes the date from the previous day, and pulls out all the info on that date. So if you run your logwatch report at 4pm, you're missing out on 16 hours worth of data! But it turns out logwatch is smarter than that …
Command to find all image files which are not really image files!
Quick one this … so you've got a compromised webserver and you want to check the files on it. Many scanning tools will ignore images, but an image might not always be what it seems! Check them all with this command: find /path/to/dir -regex ".*\.\(jpg\|png\|gif\)" -exec file {} \; | grep -i -v "image data" … Read more