This is a typical report you would receive from Epylog. All names changed to protect the innocent and make fun of the guilty. :)

The "First event" and the "Last event" are calculated based upon the timestamps found in the logs. If your machines have skewed clocks, there will be skewed results here.

The logins report goes first by default. As you can see here, root logins and root failures are listed namely. The first column is the name of the system to which root hath logged in. The second column is the login method, and the third column is user@remotehost. If remotehost is N/A, then only the username is displayed. If the username is not available, well, then it's omitted.

This is the list of users logging in and failing to do so. You will notice that some entries have a hostname in red -- there is an option for the logins module where you can specify which domains are "trusted." E.g. this run was with "duke.edu" set as a trusted domain, so anyone logging in from a remote host not matching "duke.edu" will get their remote hostname highlighted in red.

This is a firewall report. The firewall module will happily process ipchains, iptables, and ipfilter reports, though they might require some configuration. The columns go like this: number of packets, offending remote host, reporting victim host, log method, and the port on which the violation has occurred. If there are more than 10 hosts hit, or more than 10 ports probed, the logins module will collapse the report nicely, so it's not a kilometer long. If you don't like the number 10, you can set a different one in the logins module config file. If the module detects that the probe occurred on a port commonly running a trojan, the name will be highlighted in red. The trojan list is found in /etc/epylog/trojans.list and can be easily edited, or disabled entirely in the config file for the module.

This is pretty self-explanatory. The mail module will process entries by sendmail and postfix, with qmail support slated for the near future.

The spammassassin module is not enabled by default, but is handy to give you some stats about what is going on. The columns go like so: first the username (or totals), then the size of messages processed, total time spent processing, and the mean-average score. The numbers in the parentheses are (under threshold/over threshold). The default spam threshold is 5, but it can be set in the spamd module config file.

The notices module is a convenience module that will notify you of some alerts or problems. It isn't very configurable at the moment, but there will be an extra config file where custom entries can be added in the short run (before 1.0). As you can see, gconfd is still the smelliest piece of crap under the sun. :)

The weeder module makes sure that crap you don't care to know about doesn't land in the unparsed strings. This helps to lessen the size of the report dramatically. Filtered strings are configurable -- see more in the weeder.conf file.

Apr 21 10:26:54 panic0/panic0 sshd[4795]: Received disconnect from 192.168.232.146: 11: Disconnect requested by Windows SSH Client.
Apr 21 10:31:29 baraddur5/baraddur5 sshd[1051]: Server listening on 0.0.0.0 port 22.
[...skipped...]
Apr 21 10:55:33 rubeus/rubeus kernel: nfs: server hawking not responding, still trying
Apr 21 10:55:33 rubeus/rubeus kernel: nfs: server hawking OK
      

Lastly, the strings that didn't match anything are appended. This can be turned off, but not recommended -- usually these would be very useful.

A little bit of self-promotion goes a long way. :)