Basic Centos Setup #1

1. Change the default email to whatever external mail might be
echo ${EMAIL} >> /root/.forward

2. Logwatch
yum install logwatch

2.1. Edit the conf file /usr/share/logwatch/default.conf/logfiles/cron.conf
Replace line 20
Archive=cron.*
with
Archive=/var/log/cron.*

3. Aide
yum install aide

3.1. Initialize the database
aide --init

3.2. Copy the database to the regular spot
cp /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

3.3. Add a cron script to run aide daily
/etc/cron.daily/aide.cron
#!/bin/bash
/usr/sbin/aide --check | /bin/mail -s "Daily AIDE check" ${EMAIL}

Centos 5 Logwatch bug

Centos 5 seems to have a bug in the default version of logwatch that is in the repos. If you are getting :

system cat failed: 256 at /usr/sbin/logwatch line 880

Then, there is a problem wit the cron configuration. Make the following change in file /usr/share/logwatch/default.conf/logfiles/cron.conf line 20 to
Archive = /var/log/cron.*

The problem was that the cron file filter was picking up cron.* (i.e. cron.daily, cron.monthly etc) which was causing a the cat to fail, as they are directories and not simple files.