Munin contributed plugins

 warning  - defines a general warning level

            default: UNSET (meaning not configured -> no warnings)

 critical - defines a general critical level

            default: UNSET (meaning not configured -> no criticals)

 logpass_warning  - defines a warning level for successful password logins

                    default: same value as "warning", so effectively UNSET (not

                    configured) if "warning" also is not configured

 logpass_critical - defines a critical level for successful password logins

                    default: same value as "critical", so effectively UNSET (not

                    configured) if "critical" also is not configured

 logpasspam_warning   - same as "logpass_warning" but for successful PAM logins

 logpasspam_critical  - same as "logpass_critical" but for successful PAM logins

 logkey_warning   - same as "logpass_warning" but for successful PublicKey

                    logins

 logkey_critical  - same as "logpass_critical" but for successful PublicKey

                    logins

 noid_warning   - same as "logpass_warning" but for attempts with no user

                  identification

 noid_critical  - same as "logpass_critical" but for attempts with no user

                  identification

 rootattempt_warning  - same as "logpass_warning" but for root login attempts

 rootattempt_critical - same as "logpass_critical" but for root login attempts

 invusr_warning   - same as "logpass_warning" but for invalid user login

                    attempts

 invusr_critical  - same as "logpass_critical" but for invalid user login

                    attempts

 nordns_warning - same as "logpass_warning" but for connections with reverse

                  DNS for peer

 nordns_critical  - same as "logpass_critical" but for connections with reverse

                    DNS for peer

 breakin_warning  - same as "logpass_warning" but for potential breakin

                    attempts

 breakin_critical - same as "logpass_critical" but for potential breakin

                    attempts

Config example setting general warning and critical values and specific ones for

root login attempts:

  [sshd_log]

      env.warning 100

      env.critical 500

      env.rootattempt_warning 1

      env.rootattempt_critical 100

WARNING=${warning:-UNSET}

CRITICAL=${critical:-UNSET}

LOGPASS_WARNING=${logpass_warning:-$WARNING}

LOGPASS_CRITICAL=${logpass_critical:-$CRITICAL}

LOGPASSPAM_WARNING=${logpasspam_warning:-$WARNING}

LOGPASSPAM_CRITICAL=${logpasspam_critical:-$CRITICAL}

LOGKEY_WARNING=${logkey_warning:-$WARNING}

LOGKEY_CRITICAL=${logkey_critical:-$CRITICAL}

NOID_WARNING=${noid_warning:-$WARNING}

NOID_CRITICAL=${noid_critical:-$CRITICAL}

ROOTATTEMPT_WARNING=${rootattempt_warning:-$WARNING}

ROOTATTEMPT_CRITICAL=${rootattempt_critical:-$CRITICAL}

INVUSR_WARNING=${invusr_warning:-$WARNING}

INVUSR_CRITICAL=${invusr_critical:-$CRITICAL}

NORDNS_WARNING=${nordns_warning:-$WARNING}

NORDNS_CRITICAL=${nordns_critical:-$CRITICAL}

BREAKIN_WARNING=${breakin_warning:-$WARNING}

BREAKIN_CRITICAL=${breakin_critical:-$CRITICAL}

        if [ "$LOGPASS_WARNING" != "UNSET" ]; then

                echo 'LogPass.warning' "$LOGPASS_WARNING"

        fi

        if [ "$LOGPASS_CRITICAL" != "UNSET" ]; then

                echo 'LogPass.critical' "$LOGPASS_CRITICAL"

        fi

        if [ "$LOGPASSPAM_WARNING" != "UNSET" ]; then

                echo 'LogPassPAM.warning' "$LOGPASSPAM_WARNING"

        fi

        if [ "$LOGPASSPAM_CRITICAL" != "UNSET" ]; then

                echo 'LogPassPAM.critical' "$LOGPASSPAM_CRITICAL"

        fi

        if [ "$LOGKEY_WARNING" != "UNSET" ]; then

                echo 'LogKey.warning' "$LOGKEY_WARNING"

        fi

        if [ "$LOGKEY_CRITICAL" != "UNSET" ]; then

                echo 'LogKey.critical' "$LOGKEY_CRITICAL"

        fi

        if [ "$NOID_WARNING" != "UNSET" ]; then

                echo 'NoID.warning' "$NOID_WARNING"

        fi

        if [ "$NOID_CRITICAL" != "UNSET" ]; then

                echo 'NoID.critical' "$NOID_CRITICAL"

        fi

        if [ "$ROOTATTEMPT_WARNING" != "UNSET" ]; then

                echo 'rootAttempt.warning' "$ROOTATTEMPT_WARNING"

        fi

        if [ "$ROOTATTEMPT_CRITICAL" != "UNSET" ]; then

                echo 'rootAttempt.critical' "$ROOTATTEMPT_CRITICAL"

        fi

        if [ "$INVUSR_WARNING" != "UNSET" ]; then

                echo 'InvUsr.warning' "$INVUSR_WARNING"

        fi

        if [ "$INVUSR_CRITICAL" != "UNSET" ]; then

                echo 'InvUsr.critical' "$INVUSR_CRITICAL"

        fi

        if [ "$NORDNS_WARNING" != "UNSET" ]; then

                echo 'NoRDNS.warning' "$NORDNS_WARNING"

        fi

        if [ "$NORDNS_CRITICAL" != "UNSET" ]; then

                echo 'NoRDNS.critical' "$NORDNS_CRITICAL"

        fi

        if [ "$BREAKIN_WARNING" != "UNSET" ]; then

                echo 'Breakin.warning' "$BREAKIN_WARNING"

        fi

        if [ "$BREAKIN_CRITICAL" != "UNSET" ]; then

                echo 'Breakin.critical' "$BREAKIN_CRITICAL"

        fi