Patch for knockd
Brian Masney <[email protected]>
| Newsgroups | gmane.comp.log.logwatch.devel |
|---|---|
| Message-ID | <20130504003812.GB4788@brian> |
Hi, I attached the files that are necessary for Logwatch to parse the logs from knockd (http://www.zeroflux.org/projects/knock), which is a port knocking daemon. Let me know if there is anything that you would like me to change in order for this to be accepted by Logwatch. Brian P.S. I am not subscribed to the mailinglist so be sure to CC me to any replies. Brian ------------------------------------------------------------------------------ Get 100% visibility into Java/.NET code with AppDynamics Lite It's a free troubleshooting tool designed for production Get down to code-level detail for bottlenecks, with <2% overhead. Download for free and get started troubleshooting in minutes. http://p.sf.net/sfu/appdyn_d2d_ap2 _______________________________________________ Logwatch-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/logwatch-devel
logwatch-conf-logfiles-knockd.conf
(text/plain, 65 B)
LogFile = syslog Archive = syslog.* *ExpandRepeats *ApplyStdDate
logwatch-conf-services-knockd.conf
(text/plain, 56 B)
Title = "Knockd" LogFile = syslog *OnlyService = knockd
logwatch-scripts-services-knockd
(text/plain, 1.8 KB)
#!/usr/bin/perl -w
########################################################
## Copyright (c) 2013 Brian Masney
## Covered under the included MIT/X-Consortium License:
## http://www.opensource.org/licenses/mit-license.php
#########################################################
my %commands;
my %stages;
my %unknown;
while (<>)
{
chomp;
my ($line) = /\w+\s+\d+\s+\d+:\d+:\d+\s+.*?\s+knockd: (.*)/;
next if !defined ($line);
next if $line =~ /^starting up, listening on /;
next if $line =~ /OPEN SESAME$/;
next if $line =~ /: sequence timeout /;
($name, $command) = $line =~ /^(.*?): running command: (.*)/;
if (defined($name))
{
$commands{"$name: $command"}++;
next;
}
($ip, $name, $stage) = $line =~ /^(\d+\.\d+\.\d+\.\d+): (.*?): Stage (\d+)/;
if (defined ($ip))
{
$stages{$name}{$stage}{$ip}++;
next;
}
$unknown{$line}++;
}
if (keys %stages)
{
print "knockd stages reached\n";
foreach my $name (sort keys %stages)
{
print "\t$name\n";
foreach my $stage (sort keys %{$stages{$name}})
{
print "\t\tStage $stage\n";
foreach my $ip (sort keys %{$stages{$name}{$stage}})
{
print "\t\t\tFrom $ip: " . $stages{$name}{$stage}{$ip} . " time(s)\n";
}
}
}
}
if (keys %commands)
{
print "\n";
print "knockd commands executed\n";
foreach my $command (sort keys %commands)
{
print "\t" . $commands{$command} . " time(s): $command\n";
}
}
if (keys %unknown)
{
print "\n";
print "knockd unknown log entries\n";
foreach my $line (sort keys %unknown)
{
print "\t" . $unknown{$line} . " time(s): $line\n";
}
}