| Newsgroups |
gmane.comp.log.logwatch.devel |
| Message-ID |
<[email protected]> |
Revision: 119
http://logwatch.svn.sourceforge.net/logwatch/?rev=119&view=rev
Author: stefjakobs
Date: 2012-12-30 14:27:43 +0000 (Sun, 30 Dec 2012)
Log Message:
-----------
various small fixes and improvements (Thanks: Jan Synacek)
Modified Paths:
--------------
logwatch.8
scripts/services/http
scripts/services/pam_unix
scripts/services/pluto
scripts/services/secure
scripts/services/smartd
scripts/services/sshd
scripts/shared/applystddate
Modified: logwatch.8
===================================================================
--- logwatch.8 2012-12-19 10:45:00 UTC (rev 118)
+++ logwatch.8 2012-12-30 14:27:43 UTC (rev 119)
@@ -43,7 +43,7 @@
This is the detail level of the report.
.I level
can be a positive integer, or high, med, low, which correspond to the
-integers 10, 5, and 0, repectively.
+integers 10, 5, and 0, respectively.
.IP "\fB--logfile\fR log-file-group"
This will force Logwatch to process only the set of logfiles
defined by
@@ -66,7 +66,6 @@
.IP "\fB--mailto\fR address"
Mail the results to the email address or user specified in
.I address.
-This option overrides the \-\-print option.
.IP "\fB--range\fR range"
You can specify a date-range to process. Common ranges are
.I Yesterday, Today, All,
@@ -121,12 +120,12 @@
information.
.RE
.SH EXAMPLES
-.B logwatch --service ftpd-xferlog --range all --detail high --print --archives
+.B logwatch --service ftpd-xferlog --range all --detail high --archives
.RS
This will print out all FTP transfers that are stored in all current and archived
xferlogs.
.RE
-.B logwatch --service pam_pwdb --range yesterday --detail high --print
+.B logwatch --service pam_pwdb --range yesterday --detail high
.RS
This will print out login information for the previous day...
.RE
Modified: scripts/services/http
===================================================================
--- scripts/services/http 2012-12-19 10:45:00 UTC (rev 118)
+++ scripts/services/http 2012-12-30 14:27:43 UTC (rev 119)
@@ -229,7 +229,7 @@
$content_types = $content_types.'|\.class|\.jsp|\.jar|\.java';
$content_types = $content_types.'|COPYRIGHT|README|FAQ|INSTALL|\.txt)';
my $docs_types = '(\.asc|\.bib|\.djvu|\.doc|\.dot|\.dtd|\.dvi|\.gnumeric|\.mcd|\.mso|\.pdf|\.pps|\.ppt|\.ps|\.rtf|\.sxi|\.tex|\.text|\.tm|\.xls|\.xml)';
-my $archive_types = '(\.ace|\.bz2|\.cab|\.deb|\.dsc|\.ed2k|\.gz|\.hqx|\.md5|\.rar|\.rpm|\.sig|\.sign|\.tar|\.tbz2|\.tgz|\.vl2|\.z|\.zip)';
+my $archive_types = '(\.ace|\.bz2|\.cab|\.deb|\.dsc|\.ed2k|\.gz|\.hqx|\.md5|\.rar|\.rpm|\.sig|\.sign|\.tar|\.tbz2|\.tgz|\.vl2|\.z|\.zip|\.hdr)';
my $sound_types = '(\.au|\.aud|\.mid|\.mp3|\.ogg|\.pls|\.ram|\.raw|\.rm|\.wav|\.wma|\.wmv|\.xsm)';
my $movie_types = '(\.asf|\.ass|\.avi|\.idx|\.mid|\.mpg|\.mpeg|\.mov|\.qt|\.psb|\.srt|\.ssa|\.smi|\.sub)';
my $winexec_types = '(\.bat|\.com|\.exe|\.dll)';
Modified: scripts/services/pam_unix
===================================================================
--- scripts/services/pam_unix 2012-12-19 10:45:00 UTC (rev 118)
+++ scripts/services/pam_unix 2012-12-30 14:27:43 UTC (rev 119)
@@ -174,7 +174,7 @@
# ignore this line
} elsif ($line =~ s/^authentication failure; .*rhost=(\S*)\s+user=(\S*)$/$2 ($1)/) {
$data{$service}{'Authentication Failures'}{$line}++;
- } elsif ($line =~ s/^authentication failure; .*rhost=(\S*).$/unknown ($1)/) {
+ } elsif ($line =~ s/^authentication failure; .*rhost=(\S*)\s*$/unknown ($1)/) {
$data{$service}{'Authentication Failures'}{$line}++;
} elsif ($line =~ s/^authentication failure; logname=(\S*) uid=(\d+) .*user=(\S*)$/$1($2) -> $3/) {
$data{$service}{'Authentication Failures'}{$line}++;
@@ -227,8 +227,8 @@
if ($line =~ s/^password changed for (.+)/$1/) {
($Detail >= 5) && $data{$service}{'Password changed'}{$line}++;
}
- } elsif (grep $_ eq $service, qw/gdm gdm-password kdm kcheckpass xdm imap dovecot cups/) {
- if ($line =~ s/^session opened for user (.+) by \(uid=\d+\)/$1/) {
+ } elsif (grep $_ eq $service, qw/gdm gdm-password gdm-welcome kdm kcheckpass xdm imap dovecot cups/) {
+ if ($line =~ s/^session opened for user (.+) by (?:\(unknown\))?\(uid=\d+\)/$1/) {
($Detail >= 5) && $data{$service}{'Sessions Opened'}{$line}++;
} elsif ($line =~ s/^authentication failure;.* user=(.+)$/$1/) {
$data{$service}{'Authentication Failures'}{$line}++;
Modified: scripts/services/pluto
===================================================================
--- scripts/services/pluto 2012-12-19 10:45:00 UTC (rev 118)
+++ scripts/services/pluto 2012-12-30 14:27:43 UTC (rev 119)
@@ -76,7 +76,13 @@
$today="$month $day";
next unless ($process =~ /pluto/i);
+ $iserror=0;
+ if ($conn eq "ERROR:") {
+ $iserror = 1;
+ ($junk,$conn,$msg)=split(/ +/,$msg,3);
+ }
+
$loglines{$today}++;
print STDERR "Msg: $msg\n" if $debug>1;
@@ -143,7 +149,7 @@
next if($rest =~ /no suitable connection for peer/);
next if($rest =~ /sending encrypted notification/);
next if($rest =~ /enabling possible NAT-traversal with method/);
- next if($rest =~ /received Vendor ID payload/);
+ next if($rest =~ /(received|ignoring) Vendor ID payload/);
next if($rest =~ /ignoring unknown Vendor ID payload/);
next if($rest =~ /Dead Peer Detection \(RFC 3706\): enabled/);
next if($rest =~ /DPD: No response from peer - declaring peer dead/);
@@ -152,6 +158,21 @@
next if($rest =~ /discarding packet received during asynchronous work \(DNS or crypto\) in STATE_(MAIN|QUICK)_../);
next if($rest =~ /STATE_(MAIN|QUICK)_[RI][1-3]: sent [MQ][RI][1-3], expecting [MQ][IR][1-3]/);
next if($rest =~ /STATE_QUICK_R1: sent QR1, inbound IPsec SA installed, expecting QI2/);
+ next if($rest =~ /down-client output/);
+ next if($rest =~ /(restore|update)resolvconf-client output/);
+ next if($rest =~ /transform .* ignored/);
+ next if($rest =~ /multiple DH groups were set in aggressive mode\./);
+ next if($rest =~ /received mode cfg reply/);
+ next if($rest =~ /modecfg: Sending IP request/);
+ next if($rest =~ /setting .* address to/);
+ next if($rest =~ /STATE_XAUTH_I1: XAUTH client - awaiting CFG_set/);
+ next if($rest =~ /initiating Aggressive Mode/);
+ next if($rest =~ /Aggressive mode peer ID is/);
+ next if($rest =~ /protocol\/port in Phase \d ID Payload must be/);
+ next if($rest =~ /XAUTH: Bad Message: /);
+ next if($rest =~ /XAUTH: Answering XAUTH challenge with user/);
+ next if($rest =~ /Received IP4|DNS|subnet /);
+ next if($rest =~ /sendto on .* to .* failed in delete notify/);
$relevantlog{"$today"}++;
print STDERR "Rest is $rest\n" if $debug>1;
@@ -224,6 +245,9 @@
$rekeyfail{$conn}++;
$rekeyfail_ICMPunreachable{$conn}++;
+ } elsif($rest =~ /XAUTH: Successfully Authenticated/) {
+ $xauthsuccess{$conn}++;
+
} elsif($rest =~ /starting keying attempt (.*) of an unlimited number/) {
$lastattempt=$1;
if($maxattempts{$conn} < $lastattempt) {
@@ -272,6 +296,9 @@
if($setupfail{$conn} > 0) {
print "\tSetup failures: ".$setupfail{$conn}."\n";
}
+ if($xauthsuccess{$conn} > 0) {
+ print "\tXAUTH successful connections: ".$xauthsuccess{$conn}."\n";
+ }
if($crlUpdate{$conn} > 0) {
print "\tOverdue CRL update since: ".$crlUpdateSince{$conn}." (".$crlUpdate{$conn}." times)\n";
}
Modified: scripts/services/secure
===================================================================
--- scripts/services/secure 2012-12-19 10:45:00 UTC (rev 118)
+++ scripts/services/secure 2012-12-30 14:27:43 UTC (rev 119)
@@ -197,7 +197,7 @@
#Woody - specific, thanks to Michael Stovenour
if ($ThisLine =~ /^PAM_unix[\[\]0-9]*:/i ) { next; }
- if (( $ThisLine =~ /pam_succeed_if(\([a-zA-Z]*:[a-zA-Z]*\))?: requirement \"uid < 100\" (was|not) met by user /) or
+ if (( $ThisLine =~ /pam_succeed_if(\([a-zA-Z]*:[a-zA-Z]*\))?: requirement \"uid (<|>)=? 1000?\" (was|not) met by user /) or
( $ThisLine =~ /pam_rhosts_auth\[\d+\]: allowed to [^ ]+ as \w+/) or
( $ThisLine =~ /pam_rhosts_auth\([^\)]+\): allowed to [^ ]+ as \w+/) or
( $ThisLine =~ /^(.*)\(pam_unix\)/) or
@@ -225,6 +225,8 @@
( $ThisLine =~ /^sshd\(\w+\)\[\d+\]: authentication failure/) or
( $ThisLine =~ /^sshd\(\w+\)\[\d+\]: check pass; user unknown/) or
( $ThisLine =~ /^sshd\(\w+\)\[\d+\]: session /) or
+ ( $ThisLine =~ /sshd\[\d+\]: Server listening on/) or
+ ( $ThisLine =~ /sshd\[\d+\]: Received signal \d+; terminating/) or
( $ThisLine =~ /^ipop3d\[\d+\]:/) or
( $ThisLine =~ /^su\[\d+\]: [+-] .+/) or
( $ThisLine =~ /^su\[\d+\]: FAILED su for \S+ by \S+/) or #debian: done in pam_unix
@@ -232,6 +234,8 @@
( $ThisLine =~ /^login\[\d+\]: FAILED LOGIN \(\d+\) on ['`]\S+' FOR `\S+', (Authentication failure|User not known to the underlying authentication module)/) or #debian: done in pam_unix
( $ThisLine =~ /^login: FAILED LOGIN 2 FROM (.*) FOR .*, (Authentication failure|User not known to the underlying authentication module)/) or
( $ThisLine =~ /^login: pam_securetty(.*): unexpected response from failed conversation function/) or
+ ( $ThisLine =~ /^login: pam_securetty(.*): access denied: tty '.*' is not secure/) or
+ ( $ThisLine =~ /^login: pam_securetty(.*): cannot determine username/) or
( $ThisLine =~ /^pam_limits\[\d+\]/ ) or
( $ThisLine =~ /^kcheckpass(\[\d+\]|):/ ) or # done in pam_unix
( $ThisLine =~ /^cyrus\/lmtpd\[\d+\]: [^ ]+ server step [12]/ ) or
@@ -260,7 +264,8 @@
( $ThisLine =~ /polkit-grant-helper\[\d+\]: granted authorization for [^ ]* to session .* \[uid=[0-9]*\]/) or
( $ThisLine =~ /polkit-grant-helper-pam\[\d+\]: pam_thinkfinger\(polkit:auth\): conversation failed/) or
( $ThisLine =~ /polkitd\(authority=.*\): (Unr|R)egistered Authentication Agent/) or
- ( $ThisLine =~ /(gdm-session-worker|gdm-password)\[\d+\]: gkr-pam: no password is available for user/) or
+ ( $ThisLine =~ /polkitd\(authority=.*\): Operator of unix-session:/) or
+ ( $ThisLine =~ /(gdm-session-worker|gdm-password|gnome-screensaver-dialog)\[\d+\]: gkr-pam: no password is available for user/) or
( $ThisLine =~ /gkr-pam: the password for the login keyring was invalid/) or
( $ThisLine =~ /groupadd\[\d+\]: group added to /) or # Details in other messages
( $ThisLine =~ /groupmod\[\d+\]: group changed in \/etc\/gshadow /) or # Details in other messages
@@ -359,7 +364,7 @@
$NoIP->{$ThisLine}++;
} elsif ( ($Service,$Err) = ($ThisLine =~ /^([^ ]+)\[\d+\]: error: (.+)$/) ) {
$Error{$Service}{$Err}++;
- } elsif ( ($Service,$Err) = ($ThisLine =~ /^([^ ]+): (FAILED LOGIN SESSION FROM [^ ]+ FOR , .*)$/ ) ) {
+ } elsif ( ($Service,$Err) = ($ThisLine =~ /^([^ ]+): (FAILED LOGIN SESSION FROM [^ ]+ FOR ([^ ]+)?, .*)$/ ) ) {
$Error{$Service}{$Err}++;
} elsif ( ($Service,$Err) = ($ThisLine =~ /^([^ ]+): (password mismatch for [^ ]+ in [^ ]+):.*$/ ) ) {
$Error{$Service}{$Err}++;
@@ -376,6 +381,8 @@
$Error{$Service}{$Err}++;
} elsif ( $ThisLine =~ /^login(\[\d+\])*: ROOT LOGIN\s+(ON|on)\s+`?tty[0-9]+/) {
$RootLoginTTY++
+ } elsif ( $ThisLine =~ /^login(\[\d+\])*: ROOT LOGIN\s+(ON|on)\s+`?xvc[0-9]+/) {
+ $RootLoginXVC++
} elsif ( $ThisLine =~ /^com.apple.SecurityServer: authinternal authenticated user root .*/) {
$RootLoginTTY++
} elsif ( (undef,$User) = ($ThisLine =~ /^login: LOGIN ON (tty|pts\/)[0-9]+ BY ([^ ]+)/ )) {
@@ -725,6 +732,10 @@
print "\nRoot logins on ttys: $RootLoginTTY Time(s).\n";
}
+if ($RootLoginXVC) {
+ print "\nRoot logins on xvcs: $RootLoginXVC Time(s).\n";
+}
+
if (keys %UserLogin) {
print "\nUser Logins:\n";
foreach $User (sort {$a cmp $b} keys %UserLogin) {
Modified: scripts/services/smartd
===================================================================
--- scripts/services/smartd 2012-12-19 10:45:00 UTC (rev 118)
+++ scripts/services/smartd 2012-12-30 14:27:43 UTC (rev 119)
@@ -117,7 +117,7 @@
# ignore empty lines
} elsif ( ($ThisLine =~ /^smartd version/)
|| ($ThisLine =~ /^Home page/)
- || ($ThisLine =~ /^smartd .* Copyright \(C\) [0-9-]+ by Bruce Allen/)
+ || ($ThisLine =~ /^smartd .*Copyright \(C\) [0-9-]+ by Bruce Allen/)
|| ($ThisLine =~ /configuration file/i)
|| ($ThisLine =~ /\[trip Temperature is \d+ Celsius\]/)
|| ($ThisLine =~ /^Monitoring/)
Modified: scripts/services/sshd
===================================================================
--- scripts/services/sshd 2012-12-19 10:45:00 UTC (rev 118)
+++ scripts/services/sshd 2012-12-30 14:27:43 UTC (rev 119)
@@ -285,6 +285,7 @@
($ThisLine =~ /pam_succeed_if\(.*:.*\): error retrieving information about user [a-zA-Z]*/ ) or
($ThisLine =~ /pam_winbind\(sshd:account\): user .* granted access/) or
($ThisLine =~ /pam_winbind\(sshd:account\): user .* OK/) or
+ ($ThisLine =~ /pam_systemd\(sshd:session\): Moving/) or
($ThisLine =~ /PAM \d+ more authentication failures?;/) or
($ThisLine =~ /^Failed keyboard-interactive for <invalid username> from/ ) or
($ThisLine =~ /^Keyboard-interactive \(PAM\) userauth failed/ ) or
Modified: scripts/shared/applystddate
===================================================================
--- scripts/shared/applystddate 2012-12-19 10:45:00 UTC (rev 118)
+++ scripts/shared/applystddate 2012-12-30 14:27:43 UTC (rev 119)
@@ -25,6 +25,7 @@
# customize the Timefilter by appending a string:
# *ApplyStdDate = "%H:%M %d/%m/%Y"
$SearchDate = TimeFilter($ARGV[0] || '%b %e %H:%M:%S');
+$SearchDateRsyslog = TimeFilter('%Y-%m-%dT%H:%M:%S\.[0-9]+[+-][0-9]{2}:[0-9]{2}');
# The date might be "Dec 09", but it needs to be "Dec 9"...
#$SearchDate =~ s/ 0/ /;
@@ -32,11 +33,15 @@
if ( $Debug > 5 ) {
print STDERR "DEBUG: Inside ApplyStdDate...\n";
print STDERR "DEBUG: Looking For: " . $SearchDate . "\n";
+ print STDERR "DEBUG: Looking For: " . $SearchDateRsyslog . "\n";
}
while (defined($ThisLine = <STDIN>)) {
if ($ThisLine =~ m/^$SearchDate /o) {
print $ThisLine;
+ } elsif ($ThisLine =~ /^$SearchDateRsyslog /o) {
+ $ThisLine =~ s/^([0-9]{4})-([0-9]{2})-([0-9]{2})T([0-9]{2}):([0-9]{2}):([0-9]{2})\.[0-9]+[+-][0-9]{2}:[0-9]{2} //o;
+ print POSIX::strftime("%b %e %H:%M:%S", $6, $5, $4, $3+1, $2-1, $1 - 1900) . " " . $ThisLine;
} elsif ($ThisLine =~ m/(Mon|Tue|Wed|Thu|Fri|Sat|Sun) $SearchDate \d{4}/o) {
print $ThisLine;
}
This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.
------------------------------------------------------------------------------
Master Visual Studio, SharePoint, SQL, ASP.NET, C# 2012, HTML5, CSS,
MVC, Windows 8 Apps, JavaScript and much more. Keep your skills current
with LearnDevNow - 3,200 step-by-step video tutorials by Microsoft
MVPs and experts. ON SALE this month only -- learn more at:
http://p.sf.net/sfu/learnmore_123012