SF.net SVN: logwatch:[115]

[email protected]
Newsgroups gmane.comp.log.logwatch.devel
Message-ID <[email protected]>
Revision: 115
          http://logwatch.svn.sourceforge.net/logwatch/?rev=115&view=rev
Author:   stefjakobs
Date:     2012-09-25 14:05:32 +0000 (Tue, 25 Sep 2012)
Log Message:
-----------
dovecot patches from Richard Hansen:
1) match dovecot deliver lines when folders have spaces
2) simplify and improve dovecot connection table
3) Improve formatting of the dovecot deliver login
4) sort the connections deliveries, logins
5) perform reverse DNS lookups on dovecot remote IP addr

Modified Paths:
--------------
    conf/services/dovecot.conf
    scripts/services/dovecot

Modified: conf/services/dovecot.conf
===================================================================
--- conf/services/dovecot.conf	2012-09-25 13:04:23 UTC (rev 114)
+++ conf/services/dovecot.conf	2012-09-25 14:05:32 UTC (rev 115)
@@ -36,4 +36,8 @@
 # addresses (IETF RFC 1918 and RFC 3330).
 #$dovecot_ignore_host="^\[10\.|^172\.(1[6-9]|2[0-9]|3[01])\.|^192\.168\.|^127\.\d\.\d\.\d\]$"
 
+# Boolean option $dovecot_numeric is used to disable DNS lookups.
+# DNS lookups are enabled by default
+#$dovecot_numeric = 0
+
 # vi: shiftwidth=3 tabstop=3 et

Modified: scripts/services/dovecot
===================================================================
--- scripts/services/dovecot	2012-09-25 13:04:23 UTC (rev 114)
+++ scripts/services/dovecot	2012-09-25 14:05:32 UTC (rev 115)
@@ -100,6 +100,35 @@
     print STDERR "\n\nDEBUG \n\n";
 }
 
+use Socket;
+my $rdns = {};
+sub hostName {
+   (my $ipaddr) = @_;
+
+   if ($ENV{'LOGWATCH_NUMERIC'} || $ENV{'dovecot_numeric'}) {
+      return $ipaddr;
+   }
+
+   if (exists $rdns{ $ipaddr }) {
+      return $rdns{ $ipaddr };
+   }
+   $rdns{ $ipaddr } = $ipaddr;
+
+   my $iaddr = inet_aton($ipaddr);
+   if (defined $iaddr) {
+      my $host = gethostbyaddr($iaddr, AF_INET);
+      if (defined $host) {
+         my $iaddrcheck = gethostbyname($host);
+         if (defined $iaddrcheck) {
+            if ($iaddr == $iaddrcheck) {
+               $rdns{ $ipaddr } = $host;
+            }
+         }
+      }
+   }
+   return $rdns{ $ipaddr };
+}
+
 # Handle "dovecot: <svc>" and "dovecot: [ID yyyyy mail.info] <svc"
 my $dovecottag = qr/dovecot:(?:\s*\[[^]]+\])?/;
 
@@ -126,6 +155,7 @@
          $End = 0;
      } elsif ( ($User, $Host) = ( $ThisLine =~ /^pop3-login: Login: (.*?) \[(.*)\]/ ) ) {
       if ($Host !~ /$IgnoreHost/) {
+         $Host = hostName($Host);
          $Login{$User}{$Host}++;
          $LoginPOP3{$User}++;
          $ConnectionPOP3{$Host}++;
@@ -133,6 +163,7 @@
       }
    } elsif ( ($User, $Host) = ( $ThisLine =~ /^imap-login: Login: (.*?) \[(.*)\]/ ) ) {
       if ($Host !~ /$IgnoreHost/) {
+         $Host = hostName($Host);
          $Login{$User}{$Host}++;
          $LoginIMAP{$User}++;
          $ConnectionIMAP{$Host}++;
@@ -140,6 +171,7 @@
       }
    } elsif ( ($User, $Host) = ( $ThisLine =~ /managesieve-login: Login: user=\<(.*?)\>.*rip=(.*)\, lip=/ ) ) {
       if ($Host !~ /$IgnoreHost/) {
+         $Host = hostName($Host);
          $SieveLogin{$User}{$Host}++;
          $LoginSieve{$User}++;
          $ConnectionSieve{$Host}++;
@@ -151,7 +183,7 @@
       $Deliver{$User}{$Mailbox}++;
 
 # For Sieve-based delivery
-    } elsif ( ($User, $Mailbox) = ( $ThisLine =~ /^$dovecottag (?:lda\(|deliver\(|lmtp\(\d+, )(.*)\): (?:[^:]+: )?sieve: msgid=.*: stored mail into mailbox '(\S+)'/ ) ) {
+    } elsif ( ($User, $Mailbox) = ( $ThisLine =~ /^$dovecottag (?:lda\(|deliver\(|lmtp\(\d+, )(.*)\): (?:[^:]+: )?sieve: msgid=.*: stored mail into mailbox '([^']*)'/ ) ) {
       $Deliver{$User}{$Mailbox}++;
 
 # LMTP-based delivery
@@ -185,6 +217,7 @@
 # This is for Dovecot 1.0 series
     } elsif ( ($User, $Host) = ( $ThisLine =~ /^$dovecottag pop3-login: Login: user=\<(.*?)\>.*rip=(.*)\, lip=/ ) ) {
       if ($Host !~ /$IgnoreHost/) {
+         $Host = hostName($Host);
          $Login{$User}{$Host}++;
          $LoginPOP3{$User}++;
          $ConnectionPOP3{$Host}++;
@@ -192,6 +225,7 @@
       }
    } elsif ( ($User, $Host) = ( $ThisLine =~ /^$dovecottag imap-login: Login: user=\<(.*?)\>.*rip=(.*)\, lip=/) ) {
       if ($Host !~ /$IgnoreHost/) {
+         $Host = hostName($Host);
          $Login{$User}{$Host}++;
          $LoginIMAP{$User}++;
          $ConnectionIMAP{$Host}++;
@@ -227,6 +261,7 @@
    } elsif (($Reason, $Host) = ($ThisLine =~ /TLS initialization failed/) ) {
       $TLSInitFail++;
    } elsif (($Host) = ($ThisLine =~ /Aborted login \[(.*)\]/) ) {
+      $Host = hostName($Host);
       $Aborted{$Host}++;
    } elsif (($Reason) = ($ThisLine =~ /Aborted login \((.*)\):/)) {
       $Aborted{$Reason}++;
@@ -287,11 +322,12 @@
 if ( ( $Detail >= 5 ) and (keys %Connection)) {
    print     "\n[Dovecot IMAP and POP3] Connections:".
              "\n====================================".
-             "\n                                  Host |    POP3   |   IMAP   |   Total ".
-             "\n-------------------------------------- | --------- |--------- | ---------";
+             "\nPOP3 IMAP Total  Host".
+             "\n" . "-" x 72;
 
    $TLSInitFail = 0;
-   foreach $Host (sort keys %Connection) {
+   foreach $Host (sort { $Connection{$b} <=> $Connection{$a} }
+                  keys %Connection) {
       $Total = $Connection{$Host};
       if (defined ($ConnectionPOP3{$Host})) {
          $Conns = $ConnectionPOP3{$Host};
@@ -305,56 +341,39 @@
       }
 # Cleanly display IPv4 addresses
       $Host=~ s/::ffff://;
-      $HostLength = length($Host);
-      $HostSpaceLength = 38 - $HostLength;
-      $CountLength = length("$Conns");
-      $CountSpaceLength = 10 - $CountLength;
-      $IMAPLength = length("$IMAP");
-      $IMAPSpaceLength = 9 - $IMAPLength;
-      $TotalLength = length("$Total");
-      $TotalSpaceLength = 10 - $TotalLength;
-      print "\n" ." " x $HostSpaceLength . $Host . " |" . " " x $CountSpaceLength .  $Conns .
-            " |" . " " x $IMAPSpaceLength . $IMAP . " |" . " " x $TotalSpaceLength . $Total;
+      printf "\n%4s %4s %5s  %s", $Conns, $IMAP, $Total, $Host;
       $POP3Count += $Conns;
       $IMAPCount += $IMAP;
       $TotalCount += $Total;
    }
-   $POP3Length = length("$POP3Count");
-   $POP3SpaceLength = 50 - $POP3Length;
-   $IMAPLength = length("$IMAPCount");
-   $IMAPSpaceLength = 9 - $IMAPLength;
-   $TotalLength = length("$TotalCount");
-   $totalSpaceLength = 10 - $TotalLength;
-   print "\n" . "-" x 73;
-   print "\n" . " " x $POP3SpaceLength . $POP3Count . " |" . " " x $IMAPSpaceLength . $IMAPCount .
-                 " |" . " " x $totalSpaceLength . $TotalCount . "\n";
+   print "\n" . "-" x 72;
+   printf "\n%4s %4s %5s  %s", $POP3Count, $IMAPCount, $TotalCount, "Total";
 }
 
-if ( ( $Detail >= 5 ) and (keys %Deliver)) {
-   print "\n\nDovecot Deliveries:";
-   $DeliverCount = 0;
-   foreach my $User (sort keys %Deliver) {
-      print "\n  User $User:";
-      $UserCount = 0;
-      $NumMailboxes = 0;
-      foreach $Mailbox (sort keys %{$Deliver{$User}}) {
-         $NumMailboxes++;
-         $MailboxCount = $Deliver{$User}{$Mailbox};
-         print "\n    To $Mailbox: $MailboxCount Time(s)" if ($Detail >= 10);
-         $UserCount += $MailboxCount;
+if (keys %Deliver) {
+   my $DeliverCount = 0;
+   my $DeliverUserCount = {};
+   foreach my $User (keys %Deliver) {
+      foreach my $Mailbox (keys %{$Deliver{$User}}) {
+         $DeliverUserCount{$User} += $Deliver{$User}{$Mailbox};
       }
-      $DeliverCount += $UserCount;
-      if ($Detail >= 10) {
-         if ($NumMailboxes > 1) {
-	    print "\n  Total: $UserCount Time(s)\n";
-	 } else {
-	    print "\n";
-	 }
-      } elsif ($Detail >= 5) {
-         print " $UserCount Time(s)";
+      $DeliverCount += $DeliverUserCount{$User};
+   }
+   printf "\n" if ($Detail >= 5);
+   printf "\nDovecot Deliveries: %s", $DeliverCount;
+   if ($Detail >= 5) {
+      foreach my $User (sort { $DeliverUserCount{$b} <=> $DeliverUserCount{$a} }
+                        keys %DeliverUserCount) {
+         printf "\n  %4s %s", $DeliverUserCount{$User}, $User;
+         if ($Detail >= 10) {
+            foreach my $Mailbox (sort {
+               $Deliver{$User}{$b} <=> $Deliver{$User}{$a}
+                              } keys %{$Deliver{$User}}) {
+               printf "\n      %4s %s", $Deliver{$User}{$Mailbox}, $Mailbox;
+            }
+         }
       }
    }
-   print "\nTotal: $DeliverCount successful deliveries";
 }
 
 if (($Detail >= 10) and (keys %Forwarded)) {
@@ -398,40 +417,35 @@
 }
 
 
-if ( ( $Detail >= 5 ) and (keys %Login)) {
-   print "\n\nDovecot IMAP and POP3 Successful Logins:";
-   $LoginCount = 0;
-   foreach my $User (sort keys %Login) {
-      print "\n  User $User:";
-      if ( ($Detail >= 10) and ($LoginPOP3{$User} > 0 || $LoginIMAP{$User} > 0) ) {
-         print "   (";
-         if ($LoginPOP3{$User} > 0) { print "$LoginPOP3{$User} POP3"; };
-         if ($LoginPOP3{$User} > 0 && $LoginIMAP{$User} > 0) { print "/"; };
-         if ($LoginIMAP{$User} > 0) { print "$LoginIMAP{$User} IMAP"; };
-         print ")";
+if (keys %Login) {
+   my $LoginCount = 0;
+   my $LoginUserCount = {};
+   foreach my $User (keys %Login) {
+      foreach my $Host (keys %{$Login{$User}}) {
+         $LoginUserCount{$User} += $Login{$User}{$Host};
       }
-      $UserCount = 0;
-      $NumHosts = 0;
-      foreach $Host (sort keys %{$Login{$User}}) {
-         $NumHosts++;
-         $HostCount = $Login{$User}{$Host};
-# Cleanly display IPv4 addresses
-         $Host=~ s/::ffff://;
-         print "\n    From $Host: $HostCount Time(s)" if ($Detail >= 10);
-         $UserCount += $HostCount;
+      $LoginCount += $LoginUserCount{$User};
+      $LoginPOP3{$User} = 0 if $LoginPOP3{$User} <= 0;
+      $LoginIMAP{$User} = 0 if $LoginIMAP{$User} <= 0;
+   }
+   printf "\n" if ($Detail >= 5);
+   printf "\nDovecot IMAP and POP3 Successful Logins: %s", $LoginCount;
+   if ($Detail >= 5) {
+      foreach my $User (sort { $LoginUserCount{$b} <=> $LoginUserCount{$a} }
+                        keys %LoginUserCount) {
+         printf("\n  %4s %s", $LoginUserCount{$User}, $User);
+         if ($Detail >= 10) {
+            printf(" (%s POP3, %s IMAP)", $LoginPOP3{$User}, $LoginIMAP{$User});
+            foreach my $Host (sort { $Login{$User}{$b} <=> $Login{$User}{$a} }
+                              keys %{$Login{$User}}) {
+               $HostCount = $Login{$User}{$Host};
+               # Cleanly display IPv4 addresses
+               $Host=~ s/::ffff://;
+               printf "\n      %4s %s", $Login{$User}{$Host}, $Host;
+            }
+         }
       }
-      $LoginCount += $UserCount;
-      if ($Detail >= 10) {
-         if ($NumHosts > 1) {
-            print "\n  Total: $UserCount Time(s)\n";
-         } else {
-	    print "\n";
-	 }
-      } elsif ($Detail >= 5) {
-         print " $UserCount Time(s)";
-      }
    }
-   print "\nTotal: $LoginCount successful logins";
 }
 
 if ( ( $Detail >= 10 ) and (keys %SieveLogin)) {
@@ -465,10 +479,18 @@
 }
 
 if (keys %Disconnected) {
-   print "\n\nDovecot disconnects:";
-   foreach my $Reason (sort keys %Disconnected) {
-      print "\n   $Reason: $Disconnected{$Reason} Time(s)";
+   my $Disconnects = 0;
+   foreach my $Reason (%Disconnected) {
+      $Disconnects += $Disconnected{$Reason};
    }
+   printf "\n" if ($Detail >= 5);
+   printf "\nDovecot disconnects: %s", $Disconnects;
+   if ($Detail >= 5) {
+      foreach my $Reason (sort { $Disconnected{$b} <=> $Disconnected{$a} }
+                          keys %Disconnected) {
+         printf "\n  %4s %s", $Disconnected{$Reason}, $Reason;
+      }
+   }
 }
 
 if (keys %ConnectionCl) {

This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.


------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.