Logwatch Exim script
Chris Wilson <[email protected]>
| Newsgroups | gmane.comp.log.logwatch.devel |
|---|---|
| Message-ID | <alpine.LRH.2.00.0908231111110.24717@localhost> |
Dear sirs, I'm using Logwatch 4.36 and there are quite a few messages in my configuration (e.g. from exim 4.69) which are not detected properly, and reported as "Unmatched Entries". I thought you might like to see the attached patch which improves things for me. It does three things: * When "HELO verify failed" is used as a warning (to add a header to the message for later spam filters), it is not printed in the summary. * Treats "rejected EHLO or HELO from" the same as "rejected EHLO from" and "rejected HELO from" (I guess the message has changed). * Treats all unmatched "rejected RCPT" messages as DontAccept, rather than unmatched entries. This part may be controversial. I hope you will consider my patch and merge it into Logwatch. Cheers, Chris. -- _____ __ _ \ __/ / ,__(_)_ | Chris Wilson <0000 at qwirx.com> - Cambs UK | / (_/ ,\/ _/ /_ \ | Security/C/C++/Java/Ruby/Perl/SQL Developer | \__/_/_/_//_/___/ | We are GNU : free your mind & your software | _______________________________________________ Logwatch-Devel mailing list [email protected] http://www2.list.logwatch.org:81/mailman/listinfo/logwatch-devel
logwatch-exim.patch
(text/plain, 1.8 KB)
--- /usr/share/logwatch/scripts/services/exim.orig 2009-08-23 10:41:51.000000000 +0100
+++ /usr/share/logwatch/scripts/services/exim 2009-08-23 13:11:22.000000000 +0100
@@ -168,6 +168,10 @@
# Common error from SPAM hosts.
$Proto{$ThisLine}++;
}
+ elsif ( $ThisLine =~ /Warning: HELO verify failed/ ) {
+ # Common error from SPAM hosts.
+ $HeloVerify{$ThisLine}++;
+ }
elsif ( $ThisLine =~ /unexpected disconnection while reading SMTP command/ ) {
# Common error from SPAM hosts.
$Proto{$ThisLine}++;
@@ -209,7 +213,7 @@
# this is an extra error message when logging is high
# and since another message duplicates it, we can just ignore this
}
- elsif ( $ThisLine =~ /rejected [HE][EH]LO from\s/ ) {
+ elsif ( $ThisLine =~ /rejected (HELO)|(EHLO)|(EHLO or HELO) from\s/ ) {
# Typically due to underscores _ in the HELO line
# (a common protocol violation)
# Also can be due to odd escape sequences
@@ -246,7 +250,9 @@
# Count of individual Message Lines, used for sort
$licze++; # Dodaje taki licznik aby potem przy wypisaniu posortowac po nim, bo wypisywal nie po kolei
$mmsg{$mid}{$licze.$mrest} = "$mdate $mtime";
-
+ }
+ elsif ( $ThisLine =~ /rejected RCPT/ ) {
+ $DontAccept{$ThisLine}++;
}
else
{
@@ -491,7 +497,7 @@
$cc = "Sudden disconnect while expecting remote input";
( $bb ) = ($ThisOne =~ m/\[(\d+\.\d+\.\d+\.\d+)\]/);
}
- elsif ( $ThisOne =~ m/rejected ([HE][EH])LO from \[(\d+\.\d+\.\d+\.\d+)\]\:\s(.*?):\s(.*?)$/ ) {
+ elsif ( $ThisOne =~ m/rejected (HELO)|(EHLO)|(ELHO or HELO) from \[(\d+\.\d+\.\d+\.\d+)\]\:\s(.*?):\s(.*?)$/ ) {
$cc = "Rejected HELO/EHLO: $3";
$bb = "$2 ($1LO $4)";
}