Fwd: Ignore pam_unix in saslauthd

------------------------------------------------------
Kirk Bauer <[email protected]>
http://linux.kaybee.org | www.logwatch.org
Author, Automating UNIX & Linux Administration


---------- Forwarded message ----------
From: Orion Poplawski <[email protected]>
Date: Wed, Oct 15, 2008 at 10:33 AM
Subject: Ignore pam_unix in saslauthd
To: [email protected]


Oct 12 07:38:19 earth saslauthd[7182]: pam_unix(smtp:auth): authentication
failure; logname= uid=0 euid=0 tty= ruser= rhost= user=aaronb

diff -u -r1.4 saslauthd
--- saslauthd   30 Jun 2008 23:07:51 -0000      1.4
+++ saslauthd   15 Oct 2008 17:31:34 -0000
@@ -60,7 +60,8 @@
 while (defined($ThisLine = <STDIN>)) {
   if (
      ( $ThisLine =~ m/^DEBUG: / ) or
-      ( $ThisLine =~ m/^ipc_init        : listening on socket:/ )
+      ( $ThisLine =~ m/^ipc_init        : listening on socket:/ ) or
+      ( $ThisLine =~ m/^pam_unix\(.*:.*\)/)
   ) {
      # We don't care about these
   } elsif ( ($User,$Service,$Realm,$Mechanism,$Reason) = ($ThisLine =~
/^do_auth         : auth failure: \[user=(.*)\] \[service=([^ ]*)\]
\[realm=([^ ]*)\] \[mech=([^ ]*)\] \[reason=(.*)\]$/) ) {

-- 
Orion Poplawski
Technical Manager                     303-415-9701 x222
NWRA/CoRA Division                    FAX: 303-415-9702
3380 Mitchell Lane                  [email protected]
Boulder, CO 80301              http://www.cora.nwra.com

_______________________________________________
Logwatch-Devel mailing list
[email protected]
http://www2.list.logwatch.org:81/mailman/listinfo/logwatch-devel