logwatch patches - stunnel

"gulikoza" <[email protected]> Fri, 21 Jun 2013 12:39:39 +0200

Newsgroups	gmane.comp.log.logwatch.devel
Message-ID	<[email protected]>

The stunnel service does not match any significant lines on a Centos6
machine.
I have modified the script to try to trim down the noise (it was basically a
500KB report of unmatched lines).

- the version line is not matched
- Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP line should be
ignored

The problem is that the log format is somehow different.
Client, host and service are split onto 3 different lines:

stunnel accepted connection from
connect_blocking: connected
stunnel connected remote server from

so I've matched those with logid to an array and filled $connections later
with the data.

Regards,
gulikoza

------------------------------------------------------------------------------
This SF.net email is sponsored by Windows:

Build for Windows Store.

http://p.sf.net/sfu/windows-dev2dev

_______________________________________________
Logwatch-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/logwatch-devel

logwatch-stunnel.patch (application/octet-stream, 2.4 KB)

diff --git a/scripts/services/stunnel b/scripts/services/stunnel
--- a/scripts/services/stunnel
+++ b/scripts/services/stunnel
@@ -37,6 +37,7 @@ my @OtherList = ();
 my %OtherList = ();
 my %connections = ();
 my %connectionsAllowed = ();
+my %log_connections = ();
 my %versioninfo = ();
 my $sockdata = 0;
 my $ssldata = 0;
@@ -70,6 +71,7 @@ while (defined($ThisLine = <STDIN>)) {
       $DebugCounter++;
    }
    chomp($ThisLine);
+   my ($logid) = ($ThisLine =~ /^LOG\d\[(\d+:\d+)\]:/);
    # remove leading log level and ID, eg 'LOG5[2411:3084352400]: '
    $ThisLine =~ s/^LOG\d\[\d+:\d+\]: //;
 
@@ -84,12 +86,20 @@ while (defined($ThisLine = <STDIN>)) {
       } else {
          ++$connections{$service}{$ip};
       }
+   } elsif ($ThisLine =~ m/^stunnel accepted connection from (\d+\.\d+\.\d+\.\d+):\d+/) {
+      $log_connections{$logid}{client} = $1;
+   } elsif ($ThisLine =~ m/^stunnel connected remote server from (\d+\.\d+\.\d+\.\d+):\d+/) {
+      $log_connections{$logid}{source} = $1;
+   } elsif ($ThisLine =~ m/^connect_blocking: connected (\d+\.\d+\.\d+\.\d+:\d+)/) {
+      $log_connections{$logid}{service} = $1;
    } elsif ($ThisLine =~ m/^Connection (reset|closed): (\d+) bytes sent to SSL, (\d+) bytes sent to socket/) {
       $ssldata += $2;
       $sockdata += $3;
    } elsif ($ThisLine =~ m/^Connection (reset|closed)/) {
       # ignore
-   } elsif ($ThisLine =~ m/^stunnel [\d\.]+ on [\w\-]+ [\w\+]+ with OpenSSL [\w\.]+ \d+ \w+ \d+/) {
+   } elsif ($ThisLine =~ m/^Threading:[\w]+ SSL:[\w]+/) {
+      # ignore
+   } elsif ($ThisLine =~ m/^stunnel [\d\.]+ on [\w\-]+([\w\+\s]+)?with OpenSSL [\w\.\-]+ \d+ \w+ \d+/) {
       $versioninfo{$ThisLine} = 1;
    } else {
       # Report any unmatched entries...
@@ -97,10 +107,19 @@ while (defined($ThisLine = <STDIN>)) {
    }
 }
 
+if (keys %log_connections) {
+   foreach my $entry (keys %log_connections) {
+      my $ip = $log_connections{$entry}{client};
+      my $service = $log_connections{$entry}{service};
+      $service = "Unknown" if not $service;
+      $connections{$service}{$ip}++;
+   }
+}
+
 if (keys %connections) {
-   print "\nNumber of connections per service per ip:\n";
+   print "Number of connections per service per ip:\n\n";
    foreach my $service (sort keys %connections) {
-     printf " %7s \n", $service;
+     printf " To %s\n", $service;
      my $ips = $connections{$service};
      foreach my $ip (sort keys %$ips) {
         printf "    %15s : %5d time(s)\n", $ip, $ips->{$ip};