He describes a method of log analysis where the syslog is sanitised to remove volatile information such as pid's and the datestamp:

cd /var/log
cat * | \
	sed -e 's/^.*demo//' -e 's/\[[0-9]*\]//' | \
	sort | uniq -c | \
	sort -r -n > /tmp/xx

An ignore list is then created to remove all normal entries from the log. This is done by adding lines like:

cron.*: (root) CMD (/usr/bin/at)
sendmail.*: .*to=
ftpd.*: FTP LOGIN FROM

to a file which is then applied to the output of the original script with:

cat * | grep -v -f stoplist | \
	sort, etc --

This should 'erase' all of your normal log noise and only alert you of strange activity.

I do something similar with a utility called logcheck. It does pretty much the same thing and comes with an excellent set of ignore rules. I have only needed to create some new rules for ssmtp and one of my usb devices.