Fwd: Suggestion: log converter

I'm not familiar with metalog, but at a high level this doesn't seem
like it would hurt syslog users... not sure how I feel about the
UseConvert setting or how it is implemented though...


---------- Forwarded message ----------
From: Naohiro Aota <[email protected]>
Date: Dec 9, 2007 2:52 AM
Subject: Suggestion: log converter
To: [email protected]


Hello.

I wrote a patch for LogWatch CVS to suport metalog (or other logging
programs).

Some scripts of LogWatch is written only for syslog's output. This
patch add converter : if "converter = metalog" is written in
logwatch.conf and also "UseConvert" specified in conf/logfiles/* , add
convert script (scripts/shared/metalog) which converts a cerain
logging program's output to the syslog format before other filters.
This solution makes it easier to support other logging programs and
won't affect anything unless "converter" specified.

This patch also add change to conf/logfiles/* so that LogWatch can
read output files of metalog.

Regards,
Naohiro Aota

? scripts/shared/metalog
Index: conf/logfiles/cron.conf
===================================================================
RCS file: /var/cvs/logwatch/conf/logfiles/cron.conf,v
retrieving revision 1.12
diff -u -r1.12 cron.conf
--- conf/logfiles/cron.conf     1 Oct 2007 16:55:18 -0000       1.12
+++ conf/logfiles/cron.conf     30 Nov 2007 15:26:12 -0000
@@ -14,12 +14,15 @@
 #Solaris is /var/cron/log -mgt
 LogFile = /var/cron/log
 LogFile = cron
+LogFile = cornd/current

 # If the archives are searched, here is one or more line
 # (optionally containing wildcards) that tell where they are...
 Archive = cron.*
 Archive = archiv/cron.*
+Archive = crond/log-????-??-??-??:??:??

 *RemoveService = anacron

+UseConvert
 # vi: shiftwidth=3 tabstop=3 et
Index: conf/logfiles/exim.conf
===================================================================
RCS file: /var/cvs/logwatch/conf/logfiles/exim.conf,v
retrieving revision 1.8
diff -u -r1.8 exim.conf
--- conf/logfiles/exim.conf     21 Mar 2006 01:47:28 -0000      1.8
+++ conf/logfiles/exim.conf     30 Nov 2007 15:26:12 -0000
@@ -16,10 +16,12 @@
 LogFile = exim/main.log
 LogFile = exim/mainlog
 LogFile = exim4/mainlog
+LogFile = exim/current
 Archive = exim/main.log.*
 Archive = archiv/exim/main.log.*
 Archive = exim/mainlog.*
 Archive = exim4/mainlog.*
+Archive = exim/log-????-??-??-??:??:??

 ########################################################
 # This was written by:
Index: conf/logfiles/kernel.conf
===================================================================
RCS file: /var/cvs/logwatch/conf/logfiles/kernel.conf,v
retrieving revision 1.2
diff -u -r1.2 kernel.conf
--- conf/logfiles/kernel.conf   1 Oct 2007 16:55:18 -0000       1.2
+++ conf/logfiles/kernel.conf   30 Nov 2007 15:26:12 -0000
@@ -14,10 +14,13 @@

 LogFile = kern.log
 LogFile = kern.log.0
+LogFile = kernel/current
 Archive = kern.log.*.gz
+Archive = kernel/log-????-??-??-??:??:??
 *ExpandRepeats
 *ApplyStdDate

+UseConvert
 ###########################################################################
 # Please send all comments, suggestions, bug reports,
 #    etc, to [email protected]
Index: conf/logfiles/maillog.conf
===================================================================
RCS file: /var/cvs/logwatch/conf/logfiles/maillog.conf,v
retrieving revision 1.14
diff -u -r1.14 maillog.conf
--- conf/logfiles/maillog.conf  1 Oct 2007 16:55:18 -0000       1.14
+++ conf/logfiles/maillog.conf  30 Nov 2007 15:26:12 -0000
@@ -15,6 +15,7 @@
 LogFile = syslog
 LogFile = mail.log
 LogFile = mail.log.0
+LogFile = mail/current


 # If the archives are searched, here is one or more line
@@ -24,6 +25,7 @@
 Archive = syslog.*
 Archive = archiv/maillog.*
 Archive = mail.log.*.gz
+Archive = mail/log-????-??-??-??:??:??


 # Expand the repeats (actually just removes them now)
@@ -32,4 +34,5 @@
 # Keep only the lines in the proper date range...
 *ApplyStdDate

+UseConvert
 # vi: shiftwidth=3 tabstop=3 et
Index: conf/logfiles/messages.conf
===================================================================
RCS file: /var/cvs/logwatch/conf/logfiles/messages.conf,v
retrieving revision 1.24
diff -u -r1.24 messages.conf
--- conf/logfiles/messages.conf 1 Oct 2007 16:55:18 -0000       1.24
+++ conf/logfiles/messages.conf 30 Nov 2007 15:26:12 -0000
@@ -12,12 +12,14 @@

 # What actual file?  Defaults to LogPath if not absolute path....
 LogFile = messages
+LogFile = everything/current

 # If the archives are searched, here is one or more line
 # (optionally containing wildcards) that tell where they are...
 #If you use a "-" in naming add that as well -mgt
 Archive = messages.*
 Archive = archiv/messages.*
+Archive = everything/log-????-??-??-??:??:??

 # Expand the repeats (actually just removes them now)
 *ExpandRepeats
@@ -34,4 +36,5 @@
 # Keep only the lines in the proper date range...
 *ApplyStdDate

+UseConvert
 # vi: shiftwidth=3 tabstop=3 et
Index: conf/logfiles/secure.conf
===================================================================
RCS file: /var/cvs/logwatch/conf/logfiles/secure.conf,v
retrieving revision 1.16
diff -u -r1.16 secure.conf
--- conf/logfiles/secure.conf   1 Oct 2007 16:55:18 -0000       1.16
+++ conf/logfiles/secure.conf   30 Nov 2007 15:26:12 -0000
@@ -15,6 +15,8 @@
 LogFile = authlog
 LogFile = auth.log
 LogFile = auth.log.0
+LogFile = critical/current
+LogFile = pwdfail/current

 # If the archives are searched, here is one or more line
 # (optionally containing wildcards) that tell where they are...
@@ -23,6 +25,8 @@
 Archive = archiv/secure.*
 Archive = authlog.*
 Archive = auth.log.*.gz
+Archive = critical/log-????-??-??-??:??:??
+Archive = pwdfail/log-????-??-??-??:??:??

 # Expand the repeats (actually just removes them now)
 *ExpandRepeats
@@ -30,4 +34,5 @@
 # Keep only the lines in the proper date range...
 *ApplyStdDate

+UseConvert
 # vi: shiftwidth=3 tabstop=3 et
Index: scripts/logwatch.pl
===================================================================
RCS file: /var/cvs/logwatch/scripts/logwatch.pl,v
retrieving revision 1.206
diff -u -r1.206 logwatch.pl
--- scripts/logwatch.pl 28 Nov 2007 15:46:57 -0000      1.206
+++ scripts/logwatch.pl 30 Nov 2007 15:26:14 -0000
@@ -60,6 +60,7 @@

 my (%Config, @ServiceList, @LogFileList, %ServiceData, %LogFileData);
 my (@AllShared, @AllLogFiles, @FileList);
+my $Converter;
 # These need to not be global variables one day
 my (@ReadConfigNames, @ReadConfigValues);

@@ -144,6 +145,7 @@
 &ReadConfigFile ("$ConfigDir/conf/logwatch.conf", "");
 &ReadConfigFile ("$ConfigDir/conf/override.conf", "logwatch");

+$Converter = "";

 for (my $i = 0; $i <= $#ReadConfigNames; $i++) {
    if ($ReadConfigNames[$i] eq "logfile") {
@@ -158,6 +160,8 @@
       } elsif (! grep(/^$ReadConfigValues[$i]$/, @ServiceList)) {
          push @ServiceList, $ReadConfigValues[$i];
       }
+   } elsif ($ReadConfigNames[$i] eq "converter") {
+      $Converter = $ReadConfigValues[$i];
    } else {
       $Config{$ReadConfigNames[$i]} = $ReadConfigValues[$i];
    }
@@ -771,6 +775,16 @@
    @EnvList = ();

    my $FilterText = " ";
+   if ($Converter ne "" && defined $LogFileData{$LogFile}{"useconvert"}) {
+      my $cmd = $Converter;
+      if (-f "$ConfigDir/scripts/shared/$cmd") {
+        $FilterText .= ("| $PerlVersion $ConfigDir/scripts/shared/$cmd" );
+      } elsif (-f "$BaseDir/scripts/shared/$cmd") {
+        $FilterText .= ("| $PerlVersion $BaseDir/scripts/shared/$cmd" );
+      } else {
+        die "Cannot find shared script $cmd\n";
+      }
+   }
    foreach (sort keys %{$LogFileData{$LogFile}}) {
       my $cmd = $_;
       if ($cmd =~ s/^\d+-\*//) {

use POSIX qw(uname);
my ($OSname, $hostname, $release, $version, $machine) = POSIX::uname();
while (defined($ThisLine = <STDIN>)) {
   chomp $ThisLine;
   if ($ThisLine =~ m/^(... .. ..:..:..) \[([\w\-]*)\] (.*)$/) {
     print "$1 $hostname ${2}[0000]: $3\n";
   } elsif ($ThisLine =~ m/^\s+- Last output repeated (twice|(\d+) times) -$/) {
     $times = ($1 eq "twice")?"2":$2;
     print "$hostname last message repeated $times times\n";
   } else {
     print "$ThisLine\n";
   }
}




-- 
Kirk Bauer <[email protected]>
http://linux.kaybee.org | www.logwatch.org
Author, Automating UNIX & Linux Administration