Re: Update to proftpd-messages filter

Jamie wrote:
> Apologies if this is duplicated; I sent to the mailing list before 
> subscribing first and suspect it was never delivered.
> 
>  
> 
> I couldn’t find any revision to the proftp filter after 1.20, which 
> doesn’t work at all with any recent release of ProFTPD. I made some 
> changes to fix the basic issue with the log format that was breaking it, 
> and addressed some message structures that had changed to the extent 
> that they appeared in my logs so I could deal with them. I also added a 
> feature to summarize unmatched entries (rather than list each of them). 
> It’s not extensively tested, but I figured I should send it along since 
> it works a lot better than the most current version in the CVS.
> 
>  
> 
> http://www.trewtech.com/var/proftpd-messages
> 
>  
> 

The link is broken. But I cut and pasted the whole thing and have it 
now. [We love to get diff -u patches as it makes life easier.]

1) I have

  [root@hypernova ~]# /usr/local/sbin/proftpd -v
  - ProFTPD Version 1.3.0a

And the formats you have are different. That is I still get the "old style"

Mar 16 05:34:12 hypernova proftpd[7854]: hypernova 
(61.157.58.251[61.157.58.251]) - no such user 'Administrator'

In the logs. When I ran your version I all that happened was it got rid 
of all the unmatched messages that I have been living with ;)

2) I fixed the reason why no such user does not work.

  } elsif ( ($Host,$Ip,$User) = ( $ThisLine =~ /\((.*)\[(.*)\]\) - no 
such user '(.*)'.*$/ ) ) {

The regex ends on a single "." which is not the case in my logs so 
makeing it ".*" fixes this issue for me [boy am I lazy to have not even 
looked at this in 2 years ;) ]


Sooo... I have your patches and I'll go through and try to push out a 
new version of proftpd-messages that handles things both ways.

Thanks,

-Mike