Comment on What else should I do for my home server security?
NormDeplume@lemmy.world 3 days agoThis is an elegant and brilliant idea and I love it. Finding a way to formalize a baseline and then get notified for deviations from that baseline is a fundamental requirement for having things running smoothly.
Trucule@lemmy.world 1 day ago
I’d use the same baseline approach for logs and compare counts instead of reading lines. Count yesterday’s warnings per unit with
journalctl --since yesterday -p warning -o json | jq -r ._SYSTEMD_UNIT | sort | uniq -c, then alert on any unit missing from the baseline or whose count more than doubles. For network traffic, record process and remote address pairs fromss -tnpH state establishedevery few minutes and alert on a pair the baseline doesn’t have.Drafted with AI.