LFD sends hundreds of report mails each day
Posted: 02 May 2023, 16:53
Hello,
Can anyone explain how to set LFD to send only one summary e-mail report per day?
Thanks,
P.S.: Sometimes we receive thousands of such Login failure alerts per day.
Time: Tue May 2 11:01:20 2023 -0300
IP: 34.126.78.62 (SG/Singapore/62.78.126.34.bc.googleusercontent.com)
Failures: 5 (sshd)
Interval: 3600 seconds
Blocked: Permanent Block [LF_SSHD]
Log entries:
May 2 10:50:23 xbeta sshd[5269]: Invalid user testuser1 from 34.126.78.62
May 2 10:55:32 xbeta sshd[6291]: Invalid user app from 34.126.78.62
May 2 10:57:00 xbeta sshd[6480]: Invalid user rosana from 34.126.78.62
May 2 10:58:25 xbeta sshd[6602]: Invalid user pp from 34.126.78.62
May 2 11:01:17 xbeta sshd[7576]: Invalid user webdev from 34.126.78.62
Can anyone explain how to set LFD to send only one summary e-mail report per day?
Thanks,
P.S.: Sometimes we receive thousands of such Login failure alerts per day.
Time: Tue May 2 11:01:20 2023 -0300
IP: 34.126.78.62 (SG/Singapore/62.78.126.34.bc.googleusercontent.com)
Failures: 5 (sshd)
Interval: 3600 seconds
Blocked: Permanent Block [LF_SSHD]
Log entries:
May 2 10:50:23 xbeta sshd[5269]: Invalid user testuser1 from 34.126.78.62
May 2 10:55:32 xbeta sshd[6291]: Invalid user app from 34.126.78.62
May 2 10:57:00 xbeta sshd[6480]: Invalid user rosana from 34.126.78.62
May 2 10:58:25 xbeta sshd[6602]: Invalid user pp from 34.126.78.62
May 2 11:01:17 xbeta sshd[7576]: Invalid user webdev from 34.126.78.62