I'm using a combination of Monitorix (for long-term evaluation) and Fail2ban on my machines. Both can send out email alerts, though I'm not using that feature.
For your case, I'd especially recommend Fail2Ban:
- look through logs in
/var/log
: Exactly what it does. Already ships with a set of rules which you can extend by your own (using regular expressions).
- email me about anything suspicious: not only that, it can take immediate precautions – e.g. banning a given "attacker IP" for a specified amount of time (that's behind the name: "X failed logins → Ban!").
It's quite effective, and for me runs as kind of "automatic IDS": bans hackers (web, mail, ssh and more) as well as "leechers", and a lot more. It knows about a bunch of often-used software and its log formats (e.g. Apache, OpenSSH, ProFTP, misc. mail servers), so even out-of-the-box you get something useful. Though most stuff (except for SSH) is "disabled" by default, it takes a few minutes to pick the ones you use and activate them.
Once you've got a bit familiar with it, you even start writing your own rules – and have it interact with other services (e.g. Apache's mod_security
: let that throw some "EMERGENCY" type of events, and have Fail2Ban act on them). I can only warmly recommend it.
Fail2ban
looks like the thing. Thanks! Post it as an answer and I'll accept it.