secure script patch

diff -up ./secure.pp0 ./secure
--- ./secure.pp0	2009-06-02 15:51:31.000000000 +0200
+++ ./secure	2009-06-02 15:57:27.000000000 +0200
@@ -220,6 +220,8 @@ while (defined($ThisLine = <STDIN>)) {
       ( $ThisLine =~ /^su\[\d+\]: FAILED su for \S+ by \S+/) or #debian: done in pam_unix
       ( $ThisLine =~ /^login\[\d+\]: ROOT LOGIN  on '\S+'/) or #debian: done in pam_unix (Similar message on other system is reported)
       ( $ThisLine =~ /^login\[\d+\]: FAILED LOGIN \(\d+\) on ['`]\S+' FOR `\S+', (Authentication failure|User not known to the underlying authentication module)/) or #debian: done in pam_unix
+      ( $ThisLine =~ /^login: FAILED LOGIN 2 FROM (.*) FOR .*, (Authentication failure|User not known to the underlying authentication module)/) or
+      ( $ThisLine =~ /^login: pam_securetty(.*): unexpected response from failed conversation function/) or
       ( $ThisLine =~ /^pam_limits\[\d+\]/ ) or
       ( $ThisLine =~ /^kcheckpass(\[\d+\]|):/ ) or   # done in pam_unix
       ( $ThisLine =~ /^cyrus\/lmtpd\[\d+\]: [^ ]+ server step [12]/ ) or
@@ -239,8 +241,14 @@ while (defined($ThisLine = <STDIN>)) {
       ( $ThisLine =~ /vmware-authd\[[0-9]+\]: PAM adding faulty module: [^ ]+/) or
       ( $ThisLine =~ /Connection closed by/) or
       ( $ThisLine =~ /sshd.*: Accepted \S+ for \S+ from [\d\.:a-f]+ port \d+/) or # ssh script reads this log 
-      ( $ThisLine =~ /userhelper.*: running (.*) with context (.*)/)
-
+      ( $ThisLine =~ /userhelper.*: running (.*) with context (.*)/) or
+      ( $ThisLine =~ /userhelper.*: pam_thinkfinger(.*): conversation failed/) or
+      ( $ThisLine =~ /su: PAM [0-9] more authentication failure; .*/) or
+      ( $ThisLine =~ /polkit-grant-helper\[\d+\]: granted authorization for [^ ]* to uid [0-9]* \[auth=.*\]/) or
+      ( $ThisLine =~ /polkit-grant-helper\[\d+\]: granted authorization for [^ ]* to session .* \[uid=[0-9]*\]/) or
+      ( $ThisLine =~ /polkit-grant-helper-pam\[\d+\]: pam_thinkfinger\(polkit:auth\): conversation failed/) or
+      ( $ThisLine =~ /gdm-session-worker\[\d+\]: gkr-pam: no password is available for user/) or
+      ( $ThisLine =~ /gdm-session-worker\[\d+\]: pam_namespace\(gdm:session\): Unmount of [^ ]* failed, Device or resource busy/)
    ) {
       # Ignore these entries
    } elsif ($ThisLine =~ /^spop3d/ || $ThisLine =~ /^pop\(\w+\)\[\d+\]:/) {
@@ -457,6 +465,9 @@ while (defined($ThisLine = <STDIN>)) {
    } elsif ( ($Client,$User) = ($ThisLine =~ /vmware-authd\[\d+\]: login from ([0-9\.]+) as ([^ ]+)/) ) {
       $UserLogin{$User}++;
    } elsif ( ($User) = ($ThisLine =~ /vmware-authd\[\d+\]: pam_unix_auth\(vmware-authd:auth\): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=  user=([^ ]*)/) ) {
+   } elsif ( ($User) = ($ThisLine =~ /useradd.*failed adding user `(.*)', data deleted/) ) {# failed adding user/)) {# (.*), data deleted/)) {
+      # useradd: failed adding user `rpcuser', data deleted
+      $FailedAddUsers{$User}++;
    } else {
       # Unmatched entries...
       $ThisLine =~ s/\[\d+\]:/:/;
@@ -474,6 +485,14 @@ if ($DeletedUsers) {
    print "Deleted Users:\n$DeletedUsers\n";
 }
 
+if (keys %FailedAddUsers) {
+   print "Failed adding users:\n";
+   foreach $User (keys %FailedAddUsers) {
+      print "   $User: ". $FailedAddUsers{$User}. " Time(s)\n";
+   }
+   print"\n";
+}
+
 if ($NewGroups) {
    print "New Groups:\n$NewGroups\n";
 }