Various small fixes and improvements

Fix a small typo and remove a nonexistant option.

Index: logwatch.8
===================================================================
--- logwatch.8	(revision 117)
+++ logwatch.8	(working copy)
@@ -43,7 +43,7 @@
 This is the detail level of the report.
 .I level
 can be a positive integer, or high, med, low, which correspond to the
-integers 10, 5, and 0, repectively.
+integers 10, 5, and 0, respectively.
 .IP "\fB--logfile\fR log-file-group"
 This will force Logwatch to process only the set of logfiles
 defined by
@@ -66,7 +66,6 @@
 .IP "\fB--mailto\fR address"
 Mail the results to the email address or user specified in
 .I address.
-This option overrides the \-\-print option.
 .IP "\fB--range\fR range"
 You can specify a date-range to process. Common ranges are  
 .I Yesterday, Today, All,
@@ -121,12 +120,12 @@
 information.
 .RE
 .SH EXAMPLES
-.B logwatch --service ftpd-xferlog --range all --detail high --print --archives
+.B logwatch --service ftpd-xferlog --range all --detail high --archives
 .RS
 This will print out all FTP transfers that are stored in all current and archived
 xferlogs.
 .RE
-.B logwatch --service pam_pwdb --range yesterday --detail high --print
+.B logwatch --service pam_pwdb --range yesterday --detail high 
 .RS
 This will print out login information for the previous day...
 .RE

Support rsyslog timestamp.

--- scripts/shared/applystddate.orig	2011-06-25 19:21:13.000000000 +0200
+++ scripts/shared/applystddate	2012-08-29 10:44:05.355719191 +0200
@@ -25,6 +25,7 @@
 # customize the Timefilter by appending a string:
 # *ApplyStdDate = "%H:%M %d/%m/%Y"
 $SearchDate = TimeFilter($ARGV[0] || '%b %e %H:%M:%S');
+$SearchDateRsyslog = TimeFilter('%Y-%m-%dT%H:%M:%S\.[0-9]+[+-][0-9]{2}:[0-9]{2}');
 
 # The date might be "Dec 09", but it needs to be "Dec  9"...
 #$SearchDate =~ s/ 0/  /;
@@ -32,11 +33,15 @@
 if ( $Debug > 5 ) {
    print STDERR "DEBUG: Inside ApplyStdDate...\n";
    print STDERR "DEBUG: Looking For: " . $SearchDate . "\n";
+   print STDERR "DEBUG: Looking For: " . $SearchDateRsyslog . "\n";
 }
 
 while (defined($ThisLine = <STDIN>)) {
    if ($ThisLine =~ m/^$SearchDate /o) {
       print $ThisLine;
+   } elsif ($ThisLine =~ /^$SearchDateRsyslog /o) {
+      $ThisLine =~ s/^([0-9]{4})-([0-9]{2})-([0-9]{2})T([0-9]{2}):([0-9]{2}):([0-9]{2})\.[0-9]+[+-][0-9]{2}:[0-9]{2} //o;
+      print POSIX::strftime("%b %e %H:%M:%S", $6, $5, $4, $3+1, $2-1, $1 - 1900) . " " . $ThisLine;
    } elsif ($ThisLine =~ m/(Mon|Tue|Wed|Thu|Fri|Sat|Sun) $SearchDate \d{4}/o) {
       print $ThisLine;
    }

Count .hdr files as archives.

Index: scripts/services/http
===================================================================
--- scripts/services/http	(revision 117)
+++ scripts/services/http	(working copy)
@@ -229,7 +229,7 @@
    $content_types =  $content_types.'|\.class|\.jsp|\.jar|\.java';
    $content_types =  $content_types.'|COPYRIGHT|README|FAQ|INSTALL|\.txt)';
 my $docs_types =     '(\.asc|\.bib|\.djvu|\.doc|\.dot|\.dtd|\.dvi|\.gnumeric|\.mcd|\.mso|\.pdf|\.pps|\.ppt|\.ps|\.rtf|\.sxi|\.tex|\.text|\.tm|\.xls|\.xml)';
-my $archive_types =  '(\.ace|\.bz2|\.cab|\.deb|\.dsc|\.ed2k|\.gz|\.hqx|\.md5|\.rar|\.rpm|\.sig|\.sign|\.tar|\.tbz2|\.tgz|\.vl2|\.z|\.zip)';
+my $archive_types =  '(\.ace|\.bz2|\.cab|\.deb|\.dsc|\.ed2k|\.gz|\.hqx|\.md5|\.rar|\.rpm|\.sig|\.sign|\.tar|\.tbz2|\.tgz|\.vl2|\.z|\.zip|\.hdr)';
 my $sound_types =    '(\.au|\.aud|\.mid|\.mp3|\.ogg|\.pls|\.ram|\.raw|\.rm|\.wav|\.wma|\.wmv|\.xsm)';
 my $movie_types =    '(\.asf|\.ass|\.avi|\.idx|\.mid|\.mpg|\.mpeg|\.mov|\.qt|\.psb|\.srt|\.ssa|\.smi|\.sub)';
 my $winexec_types =  '(\.bat|\.com|\.exe|\.dll)';

Adjust auth failure regexp.
Add support for gdm-welcome.

--- scripts/services/pam_unix	2012-09-27 10:01:34.177205178 +0200
+++ scripts/services/pam_unix	2012-09-27 13:39:49.697365083 +0200
@@ -174,7 +174,7 @@
 	# ignore this line
       } elsif ($line =~ s/^authentication failure; .*rhost=(\S*)\s+user=(\S*)$/$2 ($1)/) {
  	 $data{$service}{'Authentication Failures'}{$line}++;
-      } elsif ($line =~ s/^authentication failure; .*rhost=(\S*).$/unknown ($1)/) {
+      } elsif ($line =~ s/^authentication failure; .*rhost=(\S*)\s*$/unknown ($1)/) {
          $data{$service}{'Authentication Failures'}{$line}++;
       } elsif ($line =~ s/^authentication failure; logname=(\S*) uid=(\d+) .*user=(\S*)$/$1($2) -> $3/) {
          $data{$service}{'Authentication Failures'}{$line}++;
@@ -227,8 +227,8 @@
       if ($line =~ s/^password changed for (.+)/$1/) {
          ($Detail >= 5) && $data{$service}{'Password changed'}{$line}++;
       }
-   } elsif (grep $_ eq $service, qw/gdm gdm-password kdm kcheckpass xdm imap dovecot cups/) {
-      if ($line =~ s/^session opened for user (.+) by \(uid=\d+\)/$1/) {
+   } elsif (grep $_ eq $service, qw/gdm gdm-password gdm-welcome kdm kcheckpass xdm imap dovecot cups/) {
+      if ($line =~ s/^session opened for user (.+) by (?:\(unknown\))?\(uid=\d+\)/$1/) {
          ($Detail >= 5) && $data{$service}{'Sessions Opened'}{$line}++;
       } elsif ($line =~ s/^authentication failure;.* user=(.+)$/$1/) {
          $data{$service}{'Authentication Failures'}{$line}++;

--- scripts/services/pluto	2010-05-01 04:36:08.000000000 +0200
+++ scripts/services/pluto	2012-08-29 10:53:35.760260333 +0200
@@ -76,6 +76,12 @@
    $today="$month $day";
 
    next unless ($process =~ /pluto/i);
+   $iserror=0;
+
+   if ($conn eq "ERROR:") {
+      $iserror = 1;
+      ($junk,$conn,$msg)=split(/ +/,$msg,3);
+   }
 
    $loglines{$today}++;
 
@@ -143,7 +149,7 @@
    next if($rest =~ /no suitable connection for peer/);
    next if($rest =~ /sending encrypted notification/);
    next if($rest =~ /enabling possible NAT-traversal with method/);
-   next if($rest =~ /received Vendor ID payload/);
+   next if($rest =~ /(received|ignoring) Vendor ID payload/);
    next if($rest =~ /ignoring unknown Vendor ID payload/);
    next if($rest =~ /Dead Peer Detection \(RFC 3706\): enabled/);
    next if($rest =~ /DPD: No response from peer - declaring peer dead/);
@@ -152,6 +158,21 @@
    next if($rest =~ /discarding packet received during asynchronous work \(DNS or crypto\) in STATE_(MAIN|QUICK)_../);
    next if($rest =~ /STATE_(MAIN|QUICK)_[RI][1-3]: sent [MQ][RI][1-3], expecting [MQ][IR][1-3]/);
    next if($rest =~ /STATE_QUICK_R1: sent QR1, inbound IPsec SA installed, expecting QI2/);
+   next if($rest =~ /down-client output/);
+   next if($rest =~ /(restore|update)resolvconf-client output/);
+   next if($rest =~ /transform .* ignored/);
+   next if($rest =~ /multiple DH groups were set in aggressive mode\./);
+   next if($rest =~ /received mode cfg reply/);
+   next if($rest =~ /modecfg: Sending IP request/);
+   next if($rest =~ /setting .* address to/);
+   next if($rest =~ /STATE_XAUTH_I1: XAUTH client - awaiting CFG_set/);
+   next if($rest =~ /initiating Aggressive Mode/);
+   next if($rest =~ /Aggressive mode peer ID is/);
+   next if($rest =~ /protocol\/port in Phase \d ID Payload must be/);
+   next if($rest =~ /XAUTH: Bad Message: /);
+   next if($rest =~ /XAUTH: Answering XAUTH challenge with user/);
+   next if($rest =~ /Received IP4|DNS|subnet /);
+   next if($rest =~ /sendto on .* to .* failed in delete notify/);
    $relevantlog{"$today"}++;
 
    print STDERR "Rest is $rest\n" if $debug>1;
@@ -224,6 +245,9 @@
       $rekeyfail{$conn}++;
       $rekeyfail_ICMPunreachable{$conn}++;
 
+   } elsif($rest =~ /XAUTH: Successfully Authenticated/) {
+      $xauthsuccess{$conn}++;
+
    } elsif($rest =~ /starting keying attempt (.*) of an unlimited number/) {
       $lastattempt=$1;
       if($maxattempts{$conn} < $lastattempt) {
@@ -272,6 +296,9 @@
       if($setupfail{$conn} > 0) {
          print "\tSetup failures: ".$setupfail{$conn}."\n";
       }
+      if($xauthsuccess{$conn} > 0) {
+         print "\tXAUTH successful connections: ".$xauthsuccess{$conn}."\n";
+      }
       if($crlUpdate{$conn} > 0) {
          print "\tOverdue CRL update since: ".$crlUpdateSince{$conn}." (".$crlUpdate{$conn}." times)\n";
       }

Remove additional space.

Index: scripts/services/smartd
===================================================================
--- scripts/services/smartd	(revision 117)
+++ scripts/services/smartd	(working copy)
@@ -117,7 +117,7 @@
        # ignore empty lines
    } elsif ( ($ThisLine =~ /^smartd version/)
           || ($ThisLine =~ /^Home page/)
-          || ($ThisLine =~ /^smartd .* Copyright \(C\) [0-9-]+ by Bruce Allen/)
+          || ($ThisLine =~ /^smartd .*Copyright \(C\) [0-9-]+ by Bruce Allen/)
           || ($ThisLine =~ /configuration file/i)
           || ($ThisLine =~ /\[trip Temperature is \d+ Celsius\]/)
           || ($ThisLine =~ /^Monitoring/)

--- scripts/services/sshd	2011-01-07 09:16:39.000000000 +1100
+++ scripts/services/sshd	2011-04-30 23:30:48.000000000 +1000
@@ -285,6 +285,7 @@
        ($ThisLine =~ /pam_succeed_if\(.*:.*\): error retrieving information about user [a-zA-Z]*/ ) or
        ($ThisLine =~ /pam_winbind\(sshd:account\): user .* granted access/) or
        ($ThisLine =~ /pam_winbind\(sshd:account\): user .* OK/) or
+       ($ThisLine =~ /pam_systemd\(sshd:session\): Moving/) or
        ($ThisLine =~ /PAM \d+ more authentication failures?;/) or
        ($ThisLine =~ /^Failed keyboard-interactive for <invalid username> from/ ) or
        ($ThisLine =~ /^Keyboard-interactive \(PAM\) userauth failed/ ) or

Add support for xen virtual console.
Fix some 'ignore' regexps.

Index: scripts/services/secure
===================================================================
--- scripts/services/secure	(revision 117)
+++ scripts/services/secure	(working copy)
@@ -197,7 +197,7 @@
    #Woody - specific, thanks to Michael Stovenour
    if ($ThisLine =~ /^PAM_unix[\[\]0-9]*:/i ) { next; }
 
-   if (( $ThisLine =~ /pam_succeed_if(\([a-zA-Z]*:[a-zA-Z]*\))?: requirement \"uid < 100\" (was|not) met by user /) or
+   if (( $ThisLine =~ /pam_succeed_if(\([a-zA-Z]*:[a-zA-Z]*\))?: requirement \"uid (<|>)=? 1000?\" (was|not) met by user /) or
       ( $ThisLine =~ /pam_rhosts_auth\[\d+\]: allowed to [^ ]+ as \w+/) or
       ( $ThisLine =~ /pam_rhosts_auth\([^\)]+\): allowed to [^ ]+ as \w+/) or
       ( $ThisLine =~ /^(.*)\(pam_unix\)/) or
@@ -225,6 +225,8 @@
       ( $ThisLine =~ /^sshd\(\w+\)\[\d+\]: authentication failure/) or
       ( $ThisLine =~ /^sshd\(\w+\)\[\d+\]: check pass; user unknown/) or
       ( $ThisLine =~ /^sshd\(\w+\)\[\d+\]: session /) or
+      ( $ThisLine =~ /sshd\[\d+\]: Server listening on/) or
+      ( $ThisLine =~ /sshd\[\d+\]: Received signal \d+; terminating/) or
       ( $ThisLine =~ /^ipop3d\[\d+\]:/) or
       ( $ThisLine =~ /^su\[\d+\]: [+-] .+/) or
       ( $ThisLine =~ /^su\[\d+\]: FAILED su for \S+ by \S+/) or #debian: done in pam_unix
@@ -232,6 +234,8 @@
       ( $ThisLine =~ /^login\[\d+\]: FAILED LOGIN \(\d+\) on ['`]\S+' FOR `\S+', (Authentication failure|User not known to the underlying authentication module)/) or #debian: done in pam_unix
       ( $ThisLine =~ /^login: FAILED LOGIN 2 FROM (.*) FOR .*, (Authentication failure|User not known to the underlying authentication module)/) or
       ( $ThisLine =~ /^login: pam_securetty(.*): unexpected response from failed conversation function/) or
+      ( $ThisLine =~ /^login: pam_securetty(.*): access denied: tty '.*' is not secure/) or
+      ( $ThisLine =~ /^login: pam_securetty(.*): cannot determine username/) or
       ( $ThisLine =~ /^pam_limits\[\d+\]/ ) or
       ( $ThisLine =~ /^kcheckpass(\[\d+\]|):/ ) or   # done in pam_unix
       ( $ThisLine =~ /^cyrus\/lmtpd\[\d+\]: [^ ]+ server step [12]/ ) or
@@ -260,7 +264,8 @@
       ( $ThisLine =~ /polkit-grant-helper\[\d+\]: granted authorization for [^ ]* to session .* \[uid=[0-9]*\]/) or
       ( $ThisLine =~ /polkit-grant-helper-pam\[\d+\]: pam_thinkfinger\(polkit:auth\): conversation failed/) or
       ( $ThisLine =~ /polkitd\(authority=.*\): (Unr|R)egistered Authentication Agent/) or
-      ( $ThisLine =~ /(gdm-session-worker|gdm-password)\[\d+\]: gkr-pam: no password is available for user/) or
+      ( $ThisLine =~ /polkitd\(authority=.*\): Operator of unix-session:/) or
+      ( $ThisLine =~ /(gdm-session-worker|gdm-password|gnome-screensaver-dialog)\[\d+\]: gkr-pam: no password is available for user/) or
       ( $ThisLine =~ /gkr-pam: the password for the login keyring was invalid/) or
       ( $ThisLine =~ /groupadd\[\d+\]: group added to /) or    # Details in other messages
       ( $ThisLine =~ /groupmod\[\d+\]: group changed in \/etc\/gshadow /) or    # Details in other messages
@@ -359,7 +364,7 @@
       $NoIP->{$ThisLine}++;
    } elsif ( ($Service,$Err) = ($ThisLine =~ /^([^ ]+)\[\d+\]: error: (.+)$/) ) {
       $Error{$Service}{$Err}++;
-   } elsif ( ($Service,$Err) = ($ThisLine =~ /^([^ ]+): (FAILED LOGIN SESSION FROM [^ ]+ FOR , .*)$/ ) ) {
+   } elsif ( ($Service,$Err) = ($ThisLine =~ /^([^ ]+): (FAILED LOGIN SESSION FROM [^ ]+ FOR ([^ ]+)?, .*)$/ ) ) {
       $Error{$Service}{$Err}++;
    } elsif ( ($Service,$Err) = ($ThisLine =~ /^([^ ]+): (password mismatch for [^ ]+ in [^ ]+):.*$/ ) ) {
       $Error{$Service}{$Err}++;
@@ -376,6 +381,8 @@
       $Error{$Service}{$Err}++;
    } elsif ( $ThisLine =~ /^login(\[\d+\])*: ROOT LOGIN\s+(ON|on)\s+`?tty[0-9]+/) {
       $RootLoginTTY++
+   } elsif ( $ThisLine =~ /^login(\[\d+\])*: ROOT LOGIN\s+(ON|on)\s+`?xvc[0-9]+/) {
+      $RootLoginXVC++
    } elsif ( $ThisLine =~ /^com.apple.SecurityServer: authinternal authenticated user root .*/) {
       $RootLoginTTY++
    } elsif ( (undef,$User) = ($ThisLine =~ /^login: LOGIN ON (tty|pts\/)[0-9]+ BY ([^ ]+)/ )) {
@@ -725,6 +732,10 @@
    print "\nRoot logins on ttys: $RootLoginTTY Time(s).\n";
 }
 
+if ($RootLoginXVC) {
+   print "\nRoot logins on xvcs: $RootLoginXVC Time(s).\n";
+}
+
 if (keys %UserLogin) {
    print "\nUser Logins:\n";
    foreach $User (sort {$a cmp $b} keys %UserLogin) {