logwatch patches - named
"gulikoza" <[email protected]>
| Newsgroups | gmane.comp.log.logwatch.devel |
|---|---|
| Message-ID | <[email protected]> |
A busy DNS server will get a lot of unexpected RCODEs (poorly configured DNS servers). This patch will try to structure the output into a more readable form, sorted by RCODE, Zone and finally Host that caused the error. Regards, gulikoza ------------------------------------------------------------------------------ This SF.net email is sponsored by Windows: Build for Windows Store. http://p.sf.net/sfu/windows-dev2dev _______________________________________________ Logwatch-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/logwatch-devel
logwatch-named.patch
(application/octet-stream, 1.4 KB)
diff --git a/scripts/services/named b/scripts/services/named
--- a/scripts/services/named
+++ b/scripts/services/named
@@ -349,8 +349,8 @@
$NonAuthoritative{$Zone}++;
} elsif ( ($Zone) = ($ThisLine =~ /zone ([^\/]+)\/.+: refresh: retry limit for master \S+ exceeded/) ) {
$RetryLimit{$Zone}++;
- } elsif ( ($ThisLine =~ /(?:error \()?unexpected RCODE\)? \(?(.*?)\)? resolving/) ){
- $UnexpRCODE{$1}++;
+ } elsif ( ($Rcode, $Zone, $Host) = ($ThisLine =~ /(?:error \()?unexpected RCODE\)? \(?(.*?)\)? resolving '(.*)': (.*)$/) ){
+ $UnexpRCODE{$Rcode}{$Zone}{$Host}++;
} elsif ( ($ThisLine =~ /(?:error \()?FORMERR\)? resolving '[^ ]+: [.0-9a-fA-F:#]+/) or
($ThisLine =~ /DNS format error from [^ ]+ resolving [^ ]+( for client [^ ]+)?: .*/) ) {
chomp($ThisLine);
@@ -661,8 +661,14 @@
if (($Detail >= 5) and (keys %UnexpRCODE)) {
print "\n Unexpected DNS RCODEs:\n";
- foreach $ThisOne (keys %UnexpRCODE) {
- print " " . $ThisOne . ": " . $UnexpRCODE{$ThisOne} . " Time(s)\n";
+ foreach $ThisOne (sort {$a cmp $b} keys %UnexpRCODE) {
+ print " " . $ThisOne . ":\n";
+ foreach $Zone (sort {$a cmp $b} keys %{$UnexpRCODE{$ThisOne}}) {
+ print " " . $Zone . ":\n";
+ foreach $Host (sort SortIP keys %{$UnexpRCODE{$ThisOne}{$Zone}}) {
+ print " " . $Host . ": " . $UnexpRCODE{$ThisOne}{$Zone}{$Host} . " Time(s)\n";
+ }
+ }
}
}