Fwd: Patch: update postfix script for values found in 2.5

"Kirk Bauer" <[email protected]>
Newsgroups gmane.comp.log.logwatch.devel
Message-ID <[email protected]>
Sorry, heading out for vacation in a bit so can't take care of these myself...


---------- Forwarded message ----------
From: Pat Riehecky <[email protected]>
Date: Tue, May 27, 2008 at 12:11 PM
Subject: Patch: update postfix script for values found in 2.5
To: [email protected]


There are a few things logged in 2.5 (at least on my RHEL5 and Debian
boxes) that are not captured by logwatch:

TLS connections when the client presents no certificate (when acting as
a smart host in my expirence)

and

Connection errors may append the destination port when erroring out.

The attached patch fixes both issues

Thanks for making logwatch - it rocks!
Pat



-- 
Kirk Bauer <[email protected]>
http://linux.kaybee.org | www.logwatch.org
Author, Automating UNIX & Linux Administration

_______________________________________________
Logwatch-Devel mailing list
[email protected]
http://www2.list.logwatch.org:81/mailman/listinfo/logwatch-devel
logwatch_postfix.diff (text/x-patch, 1.9 KB)
--- postfix_orig	2008-05-27 10:31:49.000000000 -0500
+++ logwatch/scripts/services/postfix	2008-05-27 10:06:47.000000000 -0500
@@ -769,7 +769,7 @@
       #TD disconnect from mail.example.com[2001:dead:beef::1]
       $Totals{'Disconnection'}++;
    }
-   elsif (($host,$hostip,$reason) = ($p1 =~ /^connect to ([^[]*)\[($re_IP)\]: (.*)$/o)) {
+   elsif (($host,$hostip,$reason) = ($p1 =~ /^connect to ([^[]*)\[($re_IP)\]:2?5?:? (.*)$/o)) {
       # all "connect to" messages indicate a problem with the connection
       #TD connect to example.org[10.0.0.1]: Connection refused (port 25)
       #TD connect to mail.sample.com[10.0.0.1]: No route to host (port 25)
@@ -784,6 +784,8 @@
       #TD connect to ipv6-6.example.com[::192.9.5.5]: Connection refused (port 25)
       #TD connect to ipv6-7.example.com[::FFFF:129.144.52.38]: Connection refused (port 25)
       #TD connect to ipv6-8.example.com[2010:836B:4179::836B:4179]: Connection refused (port 25)
+      #TD connect to myhost.net[10.16.64.47]:25: Connection refused
+      #TD connect to example.com[192.168.55.20]:25: Connection timed out
       $Totals{'ConnectToFailure'}++;
       $Counts{'ConnectToFailure'}{$reason}{formathost($hostip,$host)}++;
    }
@@ -1593,7 +1595,7 @@
 
    ### smtpd_tls_loglevel >= 1
    # Server TLS messages
-   elsif ( ($status,$host,$hostip,$type) = ($p1 =~ /^(?:(Trusted|Untrusted) )?TLS connection established from ([^[]+)\[($re_IP)\]: (.*)$/o )) {
+   elsif ( ($status,$host,$hostip,$type) = ($p1 =~ /^(?:(Trusted|Untrusted|Anonymous) )?TLS connection established from ([^[]+)\[($re_IP)\]: (.*)$/o )) {
       #TD TLS connection established from example.com[192.168.0.1]: TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits) 
       # Postfix 2.5+: status: Untrusted or Trusted
       #TD Untrusted TLS connection established from example.com[192.168.0.1]: TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.