Patch: handle denied updates correctly when using bind's view feature

Hi,

See the attached file "named.patch".

The attached "named-with-view-info.patch" file is an alternative way to
fix this and provide extra information, i.e. the view name. Se comments
below.

Bind has a feature called "views" which enables it to present a
different view of a particular zone depending on the query client
address scope.

As a consequence of using this feature, bind logs extra information when
updates are denied. The current named script regexp is not capable of
coping with the extra information, so all of these entries are logged as
"Unmatched Entries". The patch addresses this problem.

Example, without the bind view feature:
02-Jul-2007 07:21:41.220 client 10.1.1.1#555: update 'example.com/IN'
denied

Example, with the bind view feature:
02-Jul-2007 07:21:41.220 client 10.1.1.1#555: view someviewname: update
'example.com/IN' denied

Note: The "named.patch" patch does not catch and log the name of the
view because I cannot be sure if changing the output will break
applications depending on logwatch output. I have therefore included an
alternative patch that does this, see the attached file
"named-with-view-info.patch". If you think it is safe to change the
output format you are free to use my patch.

Example of new format produced by "named-with-view-info.patch" :

Log entry with view feature enabled:
02-Jul-2007 07:21:41.220 client 10.1.1.1#555: view someviewname: update
'example.com/IN' denied

Yields the following output (the view name is now listed at the end):
10.1.1.1 (example.com/IN) view someviewname: 11 Time(s)

Log entry without view feature enabled:
02-Jul-2007 07:21:41.220 client 10.1.1.1#555: update 'example.com/IN'
denied

Yields the following output (returns the old format without view info):
10.1.1.1 (example.com/IN): 11 Time(s)



Best regards,
Åge Strand


-- 
Åge Strand
Team Leader / Operations Engineer Unix , Institute for Marine Research, Norway  
Phone: +47 55238500 / +47 55236863 (direct)

_______________________________________________
Logwatch-Devel mailing list
[email protected]
http://www2.list.logwatch.org:81/mailman/listinfo/logwatch-devel

--- named.old	2007-07-02 07:20:15.000000000 +0200
+++ named	2007-07-02 07:21:37.000000000 +0200
@@ -222,7 +222,7 @@
    } elsif ( ($Client) = ( $ThisLine =~ /client (.*)#\d+: query \(cache\) denied/ ) ) {
       $FullClient = LookupIP ($Client);
       $DeniedQuery{$FullClient}++;
-   } elsif ( ($Rhost, $Ldom) = ($ThisLine =~ /client ([\d\.]+)#\d+: update '(.*)' denied/)) {
+   } elsif ( ($Rhost, $Ldom) = ($ThisLine =~ /client ([\d\.]+)#\d+:.* update '(.*)' denied/)) {
       $UpdateDenied{"$Rhost ($Ldom)"}++;
    } elsif ( ($Zone) = ($ThisLine =~ /zone '([0-9a-zA-Z.-]+)' allows updates by IP address, which is insecure/)) {
       $InsecUpdate{$Zone}++;

--- named.old	2007-07-02 07:20:15.000000000 +0200
+++ named	2007-07-02 08:02:51.000000000 +0200
@@ -222,8 +222,8 @@
    } elsif ( ($Client) = ( $ThisLine =~ /client (.*)#\d+: query \(cache\) denied/ ) ) {
       $FullClient = LookupIP ($Client);
       $DeniedQuery{$FullClient}++;
-   } elsif ( ($Rhost, $Ldom) = ($ThisLine =~ /client ([\d\.]+)#\d+: update '(.*)' denied/)) {
-      $UpdateDenied{"$Rhost ($Ldom)"}++;
+   } elsif ( ($Rhost, $ViewName, $Ldom) = ($ThisLine =~ /client ([\d\.]+)#\d+:(?:( view [^ ]+):)? update '(.*)' denied/)) {
+      $UpdateDenied{"$Rhost ($Ldom)$ViewName"}++;
    } elsif ( ($Zone) = ($ThisLine =~ /zone '([0-9a-zA-Z.-]+)' allows updates by IP address, which is insecure/)) {
       $InsecUpdate{$Zone}++;
    } elsif ( ($Zone) = ($ThisLine =~ /zone ([0-9a-zA-Z.\/-]+): journal rollforward failed: journal out of sync with zone/)) {