# Routine to ignore "normal" log entries - after Marcus Ranum's
# "artificial ignorance"
#
while (<>)
{
if (/.*popper\[.*: connect from /} { next }
elsif (/.*sshd\[.*log:.*accepted/} { next }
elsif (/.*telnetd\)[*.: connect from /} { next }
elsif (/.*sshd\[.* log: RSA key.*complete/) { next }
elsif (/.*sshd\[.* log: Generating.*key/) { next }
elsif (/.*sshd\[.* log: Closing connection/) { next }
elsif (/.*ftpd\[.*: connect from/) { next }
else {print}
}
We support the SANS Log Management Summit 2006 (Click Here for more information)