Fwd: patch to deal with kernel timestamp messages

---------- Forwarded message ----------
From: David Miller <[email protected]>
Date: Fri, Mar 21, 2008 at 9:46 AM
Subject: patch to deal with kernel timestamp messages
To: [email protected]


Hi,

 Ubuntu (and probably other distro) kernels emit some sort of timestamp
 (actually, an uptime) on log messages, which while perhaps useful for
 some things, confuses logwatch.  Instead of:

      From 66.98.146.21 - 2 packets
         To xxx.xxx.xxx.xxx - 2 packets
            Service: www (tcp/80) (Inbound) - 2 packets

 one gets:

      From 66.98.146.21 - 2 packets
         To xxx.xxx.xxx.xxx - 2 packets
            Service: www (tcp/80) ([3186663.636944] Inbound) - 1 packet
            Service: www (tcp/80) ([3186666.607561] Inbound) - 1 packet

 similarly (from service kernel):

   1 Time(s): [3271383.159937] skge eth0: Link is down.
   1 Time(s): [3271384.159937] skge eth0: Link is down.

 instead of:

   2 Time(s): skge eth0: Link is down.


 I wrote a fix (attached) for my own purposes.  I don't know if this has
 been discussed before, if a patch is welcome, or if I have even done it
 "properly", but I submit it to the logwatch development team in case it
 is of some use to somebody.

 Happy hacking,


 David.


diff -ur /usr/share/logwatch/scripts/services/iptables
/etc/logwatch/scripts/services/iptables
 --- /usr/share/logwatch/scripts/services/iptables       2006-08-23
23:47:29.000000000 +0100
 +++ /etc/logwatch/scripts/services/iptables     2008-03-21
15:49:36.000000000 +0000
 @@ -102,7 +102,7 @@
    # the format for ulogd/ulogd.syslogmenu and messages differ in that
    # the earlier has no service name after the date.  So RemoveHeaders
    # doesn't work.  Therefore, we extract it here:
 -   $ThisLine =~ s/^... .. ..:..:.. ([^ ]*) (kernel: )?//;
 +   $ThisLine =~ s/^... .. ..:..:.. ([^ ]*) (kernel: )?(\[\d+\.\d+\] )?//;

    # IPCHAINS
    if( ($TU,$from,$port,$on) = ( $ThisLine =~ /IP fw-in deny \w+
(\w+) ([^:]+):\d+ ([^:]+):(\d+) / ) ){
 diff -ur /usr/share/logwatch/scripts/shared/removeheaders
/etc/logwatch/scripts/shared/removeheaders
 --- /usr/share/logwatch/scripts/shared/removeheaders    2006-12-07
08:13:21.000000000 +0000
 +++ /etc/logwatch/scripts/shared/removeheaders  2008-03-21
16:05:21.000000000 +0000
 @@ -19,7 +19,7 @@
  while (defined($ThisLine = <STDIN>)) {
     #First line is Solaris ID tag style -mgt
     $ThisLine =~ s/^... .. ..:..:.. [^ ]* [^\[:]*(\[\d*\])?: \[ID
\d+( \w+\.\w+)?] //;
 -    $ThisLine =~ s/^... .. ..:..:.. [^ ]* [^\[:]*(\[\d*\])?: //;
 +    $ThisLine =~ s/^... .. ..:..:.. [^ ]* [^\[:]*(\[\d*\])?:
(\[\d+\.\d+\] )?//;
     # the following is for those logs that use the service name, but do not
     # append the ':' right after (for example, syslogd restart).  Presumably
     # OnlyService is called before RemoveHeaders, so this should only be done





-- 
Kirk Bauer <[email protected]>
http://linux.kaybee.org | www.logwatch.org
Author, Automating UNIX & Linux Administration