SF.net SVN: logwatch:[75] scripts/services/audit

Revision: 75
          http://logwatch.svn.sourceforge.net/logwatch/?rev=75&view=rev
Author:   opoplawski
Date:     2011-12-13 21:53:56 +0000 (Tue, 13 Dec 2011)
Log Message:
-----------
Handle Fedora 16 auditctl messages

Modified Paths:
--------------
    scripts/services/audit

Modified: scripts/services/audit
===================================================================
--- scripts/services/audit	2011-12-07 16:25:13 UTC (rev 74)
+++ scripts/services/audit	2011-12-13 21:53:56 UTC (rev 75)
@@ -95,6 +95,7 @@
 my $UELimit = 10;
 my $ThisLine;
 my %Warning = ();
+my %AuditctlStatus = ();
 
 print STDERR "\n\nDEBUG: Inside audit filter\n\n" if ( $Debug >= 5 );
 
@@ -123,7 +124,8 @@
         ( $ThisLine =~ /type=[0-9]+ audit\([0-9.]*:[0-9]*\):  cwd=".*"/) or
         ( $ThisLine =~ /type=[0-9]+ audit\([0-9.]*:[0-9]*\): user/) or
         ( $ThisLine =~ /audit_printk_skb: [0-9]* callbacks suppressed/) or
-	( $ThisLine =~ /item=[0-9] name="\S*" inode=[0-9]+ dev=\S* mode=[0-9]* ouid=[0-9]* ogid=[0-9]* rdev=[0-9:]* obj=\S*/)
+	( $ThisLine =~ /item=[0-9] name="\S*" inode=[0-9]+ dev=\S* mode=[0-9]* ouid=[0-9]* ogid=[0-9]* rdev=[0-9:]* obj=\S*/) or
+	( $ThisLine =~ /^No rules$/ )
     ) {
 	# Ignore these entries
     } elsif ( $ThisLine =~ /audit\([0-9]{10}.[0-9]{3}:[0-9]\): initialized$/) {
@@ -148,6 +150,8 @@
     } elsif (( $ThisLine =~ /Audit daemon is low on disk space for logging/)  or
              ( $ThisLine =~ /Audit daemon is suspending logging due to low disk space./)) {
       $Warning{$ThisLine}++;
+    } elsif ( my ($status) = ( $ThisLine =~ /AUDIT_STATUS: (.*)/ ) ) {
+      $AuditctlStatus{$status}++; 
     } elsif ( $Detail > 9 ) {
 	if ( $ThisLine =~ /avc:\s*denied\s*{\s*([^}]+).*scontext=(\S+)\s*tcontext=(\S+)\s*tclass=(\S+)/ ) {
 	    $denials{$2.' '.$3.' ('.$1.$4 . ')'}++;
@@ -236,10 +240,17 @@
     print "        starts with pid change: $NumberOfDStartsPid \n"
 }
 
-if ($Detail and $NumberOfDStops)  {
+if ($Detail and $NumberOfDStops) {
     print "\n Number of audit daemon stops: $NumberOfDStops \n";
 }
 
+if ($Detail and keys(%AuditctlStatus)) {
+    print "\n Auditctl status:\n";
+    foreach my $key (sort keys %AuditctlStatus) {
+        print "    $key: ". $AuditctlStatus{$key} . " times\n";
+    }
+}
+
 if ($NumberOfLostMessages) {
     print "\n Number of lost messages: $NumberOfLostMessages\n";
 }

This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.


------------------------------------------------------------------------------
Systems Optimization Self Assessment
Improve efficiency and utilization of IT resources. Drive out cost and 
improve service delivery. Take 5 minutes to use this Systems Optimization 
Self Assessment. http://www.accelacomm.com/jaw/sdnl/114/51450054/