Accommodation of IPv6 for named logs

	Hello.

	I've just subscribed to this list because I've reached the stage
	of not wanting to keep on applying local maintenance to successive
	releases of the very excellent LogWatch tool instead of contributing
	fixes and easing everyone's burden.

	I expect that not all of what I've been doing will be generally
	attractive, so I'll start with the detection of IPv6 addresses in
	log messages from named.

	For reasons I'll explain further on, I don't have a mature suggestion
	yet.  The following illustration shows the kind of change I have in  
mind.
	[ No 'diff -u': it's just an illustration! ]

sixte(niall)12: diff logwatch-script-named-1.56 logwatch-script-named- 
suggested
310c310
<       $ThisLine =~ s/(client [.0-9]+)\S+/$1/;
---
 >       $ThisLine =~ s/(client [.:0-9a-f]+)\S+/$1/i;
sixte(niall)13:

	I have misgivings about this, on account of the 'i' modifier, which
	surely increases the processing needed.  OTOH, [a-fA-F] is just ugly.

	Looking at the rest of the script, I found that the regexp used to
	select an IP address differs here and there, probably reflecting
	input from different people or during different stylistic stages
	of an individual's career.  Sometimes the port number (separated
	from the address by '#') is selected as well.  The following
	variety of approaches is found.

		[0-9.#:]*
		[0-9.#]+
		([.0-9]*)#[0-9]*: (.*)/) )
		(client [.0-9]+)\S+

	I'm hesitating to submit a suggestion for updating the script because
	I don't have any sense of the group culture.  Some questions occur
	to me.

	Is it worth making these consistent when accommodating IPv6?

	Would anything significant be lost by using a very weak regexp to
	match IPv[46] addresses neutrally -- something like this?

		([^#\s]+)(#\d+)?(\S*)\s*

	This would select the address, the port, trailing punctuation or other
	junk, and trailing whitespace, and would allow the selected elements
	to be used in any desired re-writing.  It may be over-elaborate.

	I'm happy to do the work and submit patches, once I know I'm not
	"swimming against the current".

	Best regards,

	Niall O'Reilly
	University College Dublin IT Services

	PGP key ID: AE995ED9 (see www.pgp.net)
	Fingerprint: 23DC C6DE 8874 2432 2BE0 3905 7987 E48D AE99 5ED9

_______________________________________________
Logwatch-Devel mailing list
[email protected]
http://www2.list.logwatch.org:81/mailman/listinfo/logwatch-devel