Wow, people are still using logsurfer. I switched to SEC years ago.
If you don't have any idea what I'm talking about, check into Logsurfer and some documentation from CERT on the package.
Now, on with the signatures!
UPDATE: I've been way lax in keeping this page up to date with what
I'm actually doing in the real world, yet people have been finding this
stuff interesting. So, I present for your perusal--my m4-ized files,
slightly sanitized. You will more than likely run into some problem if
you use these straight out of the box, but they make for good examples of
"real world" logsurfer use.
Check Here for raw files.