I have RH7.2 running at the moment and for some reason I tried to check my root e-mail in pine. When I went in I found emails from Jan11 uptill this day.

Usually they are 2 a day:

this one
Subject: Cron <root@localhost> run-parts /etc/cron.daily

/etc/cron.daily/tripwire-check:

**** Error: Tripwire database for localhost.localdomain not found. ****
**** Run /etc/tripwire/twinstall.sh and/or tripwire --init. ****


and this one:
Subject: LogWatch for localhost.localdomain



################## LogWatch 2.1.1 Begin #####################


--------------------- sendmail Begin ------------------------

777 bytes transferred
2 messages sent
---------------------- sendmail End -------------------------


---------------- Connections (secure-log) Begin -------------------

Connections:
Service sgi_fam:
0.0.0.0: 1 Time(s)



----------------- Connections (secure-log) End --------------------



###################### LogWatch End #########################

this one always has some connection info in it

Is this normal and if so what do they do and say?

let's see, first
tripwire error is indicates that you've installed tripwire and you haven't set it up yet, it is a file monitoring tool, it looks at modifications of files on your system and tells you what files were modified, trancated or deleted on the system, it is recomended to run tripwire set up the first thing after install of OS without any networking set up etc.
Secure part of log is relevent to ssh, if you use ssh to connect to your linux box from remote location it will tell you when the sessions were conducted, and all tracking info you need if there's a suspisious activity on your ssh session.

thanx for the fast response.

now as for the tripwire thing I never installed it myself it must have came with RH7.2. Now how do I set it up?

and as for ssh, I had a feeling thats what it was but I just wanted to be sure

the email you have TELLS YOU how to set it up properly....

What can I say, my face is red

LOL

thanx for your patience