Re: Fwd: patch to deal with kernel timestamp messages

Kirk Bauer wrote:
> ---------- Forwarded message ----------
> From: David Miller <[email protected]>
> Date: Fri, Mar 21, 2008 at 9:46 AM
> Subject: patch to deal with kernel timestamp messages
> To: [email protected]
> 
> 
> Hi,
> 
>  Ubuntu (and probably other distro) kernels emit some sort of timestamp
>  (actually, an uptime) on log messages, which while perhaps useful for
>  some things, confuses logwatch.  Instead of:
> 
>       From 66.98.146.21 - 2 packets
>          To xxx.xxx.xxx.xxx - 2 packets
>             Service: www (tcp/80) (Inbound) - 2 packets
> 
>  one gets:
> 
>       From 66.98.146.21 - 2 packets
>          To xxx.xxx.xxx.xxx - 2 packets
>             Service: www (tcp/80) ([3186663.636944] Inbound) - 1 packet
>             Service: www (tcp/80) ([3186666.607561] Inbound) - 1 packet
> 
>  similarly (from service kernel):
> 
>    1 Time(s): [3271383.159937] skge eth0: Link is down.
>    1 Time(s): [3271384.159937] skge eth0: Link is down.
> 
>  instead of:
> 
>    2 Time(s): skge eth0: Link is down.
> 
> 
>  I wrote a fix (attached) for my own purposes.  I don't know if this has
>  been discussed before, if a patch is welcome, or if I have even done it
>  "properly", but I submit it to the logwatch development team in case it
>  is of some use to somebody.
> 
>  Happy hacking,
> 
> 
>  David.
> 
> 
> diff -ur /usr/share/logwatch/scripts/services/iptables
> /etc/logwatch/scripts/services/iptables
>  --- /usr/share/logwatch/scripts/services/iptables       2006-08-23
> 23:47:29.000000000 +0100
>  +++ /etc/logwatch/scripts/services/iptables     2008-03-21
> 15:49:36.000000000 +0000
>  @@ -102,7 +102,7 @@
>     # the format for ulogd/ulogd.syslogmenu and messages differ in that
>     # the earlier has no service name after the date.  So RemoveHeaders
>     # doesn't work.  Therefore, we extract it here:
>  -   $ThisLine =~ s/^... .. ..:..:.. ([^ ]*) (kernel: )?//;
>  +   $ThisLine =~ s/^... .. ..:..:.. ([^ ]*) (kernel: )?(\[\d+\.\d+\] )?//;
> 
>     # IPCHAINS
>     if( ($TU,$from,$port,$on) = ( $ThisLine =~ /IP fw-in deny \w+
> (\w+) ([^:]+):\d+ ([^:]+):(\d+) / ) ){
>  diff -ur /usr/share/logwatch/scripts/shared/removeheaders
> /etc/logwatch/scripts/shared/removeheaders
>  --- /usr/share/logwatch/scripts/shared/removeheaders    2006-12-07
> 08:13:21.000000000 +0000
>  +++ /etc/logwatch/scripts/shared/removeheaders  2008-03-21
> 16:05:21.000000000 +0000
>  @@ -19,7 +19,7 @@
>   while (defined($ThisLine = <STDIN>)) {
>      #First line is Solaris ID tag style -mgt
>      $ThisLine =~ s/^... .. ..:..:.. [^ ]* [^\[:]*(\[\d*\])?: \[ID
> \d+( \w+\.\w+)?] //;
>  -    $ThisLine =~ s/^... .. ..:..:.. [^ ]* [^\[:]*(\[\d*\])?: //;
>  +    $ThisLine =~ s/^... .. ..:..:.. [^ ]* [^\[:]*(\[\d*\])?:
> (\[\d+\.\d+\] )?//;
>      # the following is for those logs that use the service name, but do not
>      # append the ':' right after (for example, syslogd restart).  Presumably
>      # OnlyService is called before RemoveHeaders, so this should only be done
> 
>

The first patch to iptables is already in. The second patch to 
removeheaders makes me stop and think. Can anyone think of a case where 
it would break something else?

>  -    $ThisLine =~ s/^... .. ..:..:.. [^ ]* [^\[:]*(\[\d*\])?: //;
>  +    $ThisLine =~ s/^... .. ..:..:.. [^ ]* [^\[:]*(\[\d*\])?: (\[\d+\.\d+\] )?//;

It is conditional so it should no break normal syslog headers but is 
there ever a case where we want the [nnnn.nn] as part of a log?

-Mike