Fwd: patch for scripts/services/postfix: recognize "(n bytes)" after timeouts and lost connections

"Kirk Bauer" <[email protected]>
Newsgroups gmane.comp.log.logwatch.devel
Message-ID <[email protected]>
---------- Forwarded message ----------
From: Peter Johnson <[email protected]>
Date: Sun, 10 Aug 2008 20:47:43 -0400
Subject: patch for scripts/services/postfix: recognize "(n bytes)"
after timeouts and lost connections
To: [email protected]

Logwatch fails to recognize a ton of messages in my postfix logs, of the form:

    "lost connection after DATA (0 bytes) from unknown[a.b.c.d]"

The attached patch (relative to CVS sync as of 2008-08-10 20:26 EST) fixes
that, and the similar case of "timeout after BLAH (n bytes)".  I feel maximal
matching is safe here because the line always ends in "from hostname[ip]" and
the reason always lies between the "after" and the "from".

Thanks.

pete




-- 
Kirk Bauer <[email protected]>
http://linux.kaybee.org | www.logwatch.org
Author, Automating UNIX & Linux Administration

_______________________________________________
Logwatch-Devel mailing list
[email protected]
http://www2.list.logwatch.org:81/mailman/listinfo/logwatch-devel
postfix.patch (text/plain, 965 B)
--- postfix.orig	2008-08-10 20:37:44.000000000 -0400
+++ postfix	2008-08-10 20:46:41.000000000 -0400
@@ -287,13 +287,13 @@
    } elsif ( (undef) = ($ThisLine =~ /^$re_MsgID: resent-message-id=<([^ ]*)>$/)) {
       $ResentMessages++;
    } elsif (
-         ($Command,$Host) = ($ThisLine =~ /lost connection after ([^ ]*) from ([^ ]*)$/) or
+         ($Command,$Host) = ($ThisLine =~ /lost connection after (.*) from ([^ ]*)$/) or
          ($Host,$Command) = ($ThisLine =~ /^$re_MsgID: lost connection with ([^ ]*) while (.*)$/)
       ) {
       # Make some better summary with hosts
       $ConnectionLost{$Command}++;
    } elsif (
-         ($Command,$Host) = ($ThisLine =~ /timeout after ([^ ]*) from ([^ ]*)$/) or
+         ($Command,$Host) = ($ThisLine =~ /timeout after (.*) from ([^ ]*)$/) or
          ($Host,$Command) = ($ThisLine =~ /^$re_MsgID: conversation with ([^ ]*) timed out while (.*)$/)
       ) {
       # Make some better summary with hosts
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.