| Newsgroups |
gmane.comp.log.logwatch.devel |
| Message-ID |
<[email protected]> |
Revision: 154
http://sourceforge.net/p/logwatch/code/154
Author: stefjakobs
Date: 2013-07-30 15:56:23 +0000 (Tue, 30 Jul 2013)
Log Message:
-----------
* recognize more log lines
* print short summary with $Detail=med
Modified Paths:
--------------
conf/services/freeradius.conf
scripts/services/freeradius
Modified: conf/services/freeradius.conf
===================================================================
--- conf/services/freeradius.conf 2013-07-30 15:50:32 UTC (rev 153)
+++ conf/services/freeradius.conf 2013-07-30 15:56:23 UTC (rev 154)
@@ -1,6 +1,5 @@
##########################################################################
-# freeradius conf
-# Marczona 28.12.2011
+# $Id$
##########################################################################
# You can put comments anywhere you want to. They are effective for the
@@ -13,14 +12,14 @@
# Yes = True = On = 1
# No = False = Off = 0
-Title = "freeradius FKM variant"
+Title = "FreeRADIUS"
# Which logfile group...
LogFile = freeradius
#Detail=med
-#*OnlyService = radiusd
+*OnlyService = (radiusd|freeradius)
*RemoveHeaders
# vi: shiftwidth=3 tabstop=3 et
Modified: scripts/services/freeradius
===================================================================
--- scripts/services/freeradius 2013-07-30 15:50:32 UTC (rev 153)
+++ scripts/services/freeradius 2013-07-30 15:56:23 UTC (rev 154)
@@ -29,7 +29,11 @@
my %loginsOk = ();
my %wrongPassword = ();
my %wrongUser = ();
-my %wrong_ip = ();
+my %wrong_ip = ();
+my %invalidUser = ();
+my %discardRequest = ();
+my %warnings = ();
+my $killedChilds = 0;
my $ThisLine;
while (defined($ThisLine = <STDIN>)) {
@@ -39,15 +43,66 @@
}
chomp($ThisLine);
- if ( my $user = ($ThisLine =~ m/^Auth: Login OK: \[(.+)\] \(from client [^ ]* port \d{1,10} cli \d+.\d+.\d+.\d+\)/) ) {
+ if ( ( $ThisLine =~ /^F-TICKS/ ) ||
+ ( $ThisLine =~ /^Access-Request from/ ) ||
+ ( $ThisLine =~ /^ \.\.\. (?:closing|adding new) socket/ ) ||
+ ( $ThisLine =~ /^(?:SSL|TLS|rlm_(?:unix|eap|sql|radutmp)| TLS_accept| \[ldap\])/ ) ||
+ ( $ThisLine =~ /^Ready to process requests\.$/ ) ||
+ ( $ThisLine =~ /^Exiting normally\.$/ ) ||
+ ( $ThisLine =~ /^Loaded virtual server/ )
+ ) {
+ # ignore
+ }
+
+ # TD: Login OK: [[email protected]] (from client radius port 0)
+ # TD: Login OK: [[email protected]] (from client radius port 9 cli 00-11-22-33-44-AA;eduroam via TLS tunnel)
+ elsif ( my ($user) = ($ThisLine =~ m/^(?:Auth: )?Login OK: \[(.+)\] \(from client [^ ]* port \d{1,10}(?: cli [-0-9a-fA-F.:]+)?(?:;\w+)?(?: via TLS tunnel)?\)/) ) {
$loginsOk{$user}++;
- } elsif ( my ($user, $ip) = ( $ThisLine =~ m/^Auth: Login incorrect \(rlm_pap: CLEAR TEXT password check failed\): \[(.+)\] \(from client [^ ]* port \d{1,10} cli (\d+.\d+.\d+.\d+)\)/) ) {
+
+ }
+
+ # TD: Login incorrect ( [ldap] User not found): [[email protected]] (from client radius port 13 cli 38-16-dd-aa-bb-cc via TLS tunnel)
+ # TD: Login incorrect (mschap: External script says Logon failure (0xc000006d)): [[email protected]] (from client radius port 13 cli aa-bb-cc-11-22-33 via TLS tunnel)
+ # TD: Login incorrect (TLS Alert write:fatal:handshake failure): [[email protected]] (from client radius port 13 cli aa-bb-cc-11-22-33)
+ # TD:
+ elsif ( my ($user, $ip) = ( $ThisLine =~ m/^(?:Auth: )?Login incorrect \(.+\): \[(.*)\] \(from client [^ ]* port \d{1,10}(?: cli ([-0-9a-fA-F.:]+))?(?: via TLS tunnel)?\)/) ) {
+ if (! $ip) { $ip = "not named"; }
+ $wrongUser{$ip}{$user}++;
+ $wrong_ip{$ip}++;
+
+ }
+
+ # TD: Login incorrect: [[email protected]] (from client radius port 175143 cli cc08.e051.a240)
+ # TD: Login incorrect: [[email protected]] (from client radius1 port 0)
+ elsif ( my ($user, $ip) = ($ThisLine =~ m/^(?:Auth: )?Login incorrect: \[(.+)\] \(from client [^ ]* port \d{1,10}(?: cli ([-0-9a-fA-F.:]+))?(?: via TLS tunnel)?\)/) ) {
+ if (! $ip) { $ip = "not named"; }
$wrongPassword{$ip}{$user}++;
$wrong_ip{$ip}++;
- } elsif ( my ($user, $ip) = ($ThisLine =~ m/^Auth: Login incorrect: \[(.+)\] \(from client [^ ]* port \d{1,10} cli (\d+.\d+.\d+.\d+)\)/) ) {
- $wrongUser{$ip}{$user}++;
- $wrong_ip{$ip}++;
- } else {
+ }
+
+ # TD: Invalid user ( [ldap] Access Attribute denies access): [[email protected]] (from client radius port 13 cli aa-bb-cc-dd-ee-11 via TLS tunnel)
+ elsif ( my ($reason, $user, $ip) = ($ThisLine =~ m/^(?:Auth: )?Invalid user \(\s*(.+)\): \[(.+)\] \(from client [^ ]* port \d{1,10}(?: cli ([-0-9a-fA-F.:]+))?(?: via TLS tunnel)?\)/) ) {
+ if (! $ip) { $ip = "not named"; }
+ $invalidUser{$reason}{$user}++;
+ }
+
+ # TD: Discarding duplicate request from client <host> port 47609 - ID: 182 due to unfinished request 12713766
+ elsif ( my ($client) = ($ThisLine =~ /Discarding duplicate request from client (\S+) port \d+ - ID: \d+ due to unfinished request/) ) {
+ $discardRequest{$client}++;
+ }
+
+ # TD: Child PID 57436 is taking too much time: forcing failure and killing child.
+ elsif ( $ThisLine =~ m/Child PID \d+ is taking too much time: forcing failure and killing child/ ) {
+ $killedChilds++;
+ }
+
+ # TD: WARNING: Unresponsive child for request 4737598, in component accounting module unix
+ # TD: WARNING: Child is hung for request 4737598 in component accounting module unix.
+ elsif ( $ThisLine =~ m/^WARNING: (Unresponsive child|Child is hung) for request \d+,? in component (\w+) module ?(\w*)/ ) {
+ $warnings{$1}{"$2 [module: $3]"}++;
+ }
+
+ else {
# Report any unmatched entries...
$OtherList{$ThisLine}++;
}
@@ -62,50 +117,119 @@
return $wrong_ip{$b} <=> $wrong_ip{$a};
}
-if ($Detail >= 10) {
- if (keys %loginsOk) {
+if (keys %loginsOk) {
+ if ($Detail >= 10) {
print "\nSuccessful logins:\n";
- my $user;
- foreach $user (sort {$loginsOk{$b} <=> $loginsOk{$a}} keys %loginsOk) {
- # print $user, " ";
- # print $loginsOk{$user};
- printf " %10s : %3d time(s)\n", $user, $loginsOk{$user};
+ foreach my $user (sort {$loginsOk{$b} <=> $loginsOk{$a}} keys %loginsOk) {
+ printf " %-40s : %5d time(s)\n", $user, $loginsOk{$user};
}
+ } elsif ($Detail >= 6) {
+ my $loginsOkSum = 0;
+ foreach my $user (keys %loginsOk) {
+ $loginsOkSum += $loginsOk{$user};
+ }
+ printf "\n%-42s : %5d time(s)\n", "Successful logins", $loginsOkSum;
}
}
-if ($Detail >= 5) {
+if ($Detail >= 8) {
if (keys %wrong_ip) {
print "\nSum of failed logins per ip (wrong password or user)\n";
foreach my $ip (sort compPerIp keys %wrong_ip) {
- printf " %15s : %3d time(s)\n", $ip, $wrong_ip{$ip};
+ printf " %-40s : %5d time(s)\n", $ip, $wrong_ip{$ip};
}
}
}
if (keys %wrongUser) {
- print "\nFailed logins - wrong user name:\n";
- foreach my $ip (sort compPerIp keys %wrongUser) {
- printf " %15s\n", $ip;
- my $users = $wrongUser{$ip};
- foreach my $user (sort {$users->{$b} <=> $users->{$a}} keys %$users) {
- printf "%20s : %3d time(s)\n", $user, $users->{$user};
- }
+ if ($Detail >= 6) {
+ print "\nFailed logins - wrong user name:\n";
+ foreach my $ip (sort compPerIp keys %wrongUser) {
+ printf " %-40s\n", $ip;
+ my $users = $wrongUser{$ip};
+ foreach my $user (sort {$users->{$b} <=> $users->{$a}} keys %$users) {
+ printf " %-38s : %5d time(s)\n", $user, $users->{$user};
+ }
+ }
+ } else {
+ my $userSum = 0;
+ foreach my $ip (keys %wrongUser) {
+ my $users = $wrongUser{$ip};
+ foreach my $user (keys %$users) {
+ $userSum += $users->{$user};
+ }
+ }
+ printf "\n%-42s : %5d time(s)\n", "Failed logins - wrong user name", $userSum;
}
}
if (keys %wrongPassword) {
- print "\nFailed logins - wrong password:\n";
- foreach my $ip (sort compPerIp keys %wrongPassword) {
- my $users = $wrongPassword{$ip};
- printf " %15s\n", $ip ;
- foreach my $user (sort {$users->{$b} <=> $users->{$a}} keys %$users) {
- #print " $user ", $users->{$user}, " time(s)\n";
- printf "%20s : %3d time(s)\n", $user, $users->{$user};
- }
+ if ($Detail >= 6) {
+ print "\nFailed logins - wrong password:\n";
+ foreach my $ip (sort compPerIp keys %wrongPassword) {
+ my $users = $wrongPassword{$ip};
+ printf " %-40s\n", $ip ;
+ foreach my $user (sort {$users->{$b} <=> $users->{$a}} keys %$users) {
+ #print " $user ", $users->{$user}, " time(s)\n";
+ printf " %-38s : %5d time(s)\n", $user, $users->{$user};
+ }
+ }
+ } else {
+ my $wrongPasswordSum = 0;
+ foreach my $ip (%wrongPassword) {
+ my $users = $wrongPassword{$ip};
+ foreach my $user (keys %$users) {
+ $wrongPasswordSum += $users->{$user};
+ }
+ }
+ printf "\n%-42s : %5d time(s)\n", "Failed logins - wrong password", $wrongPasswordSum;
}
}
+if (keys %invalidUser) {
+ if ($Detail >= 6) {
+ print "\nInvalid User:\n";
+ foreach my $reason (keys %invalidUser) {
+ my $users = $invalidUser{$reason};
+ printf " %-40s\n", $reason;
+ foreach my $user (sort {$users->{$b} <=> $users->{$a}} keys %$users) {
+ printf " %-38s : %5d time(s)\n", $user, $users->{$user};
+ }
+ }
+ } else {
+ my $invalidUserSum = 0;
+ foreach my $reason (keys %invalidUser) {
+ my $users = $invalidUser{$reason};
+ foreach my $user (keys %$users) {
+ $invalidUserSum += $users->{$user};
+ }
+ }
+ printf "\n%-42s : %5d time(s)\n", "Invalid Users", $invalidUserSum;
+ }
+}
+
+if (keys %discardRequest) {
+ print "\nDuplicate requests discarded from client:\n";
+ foreach my $client (keys %discardRequest) {
+ printf " %-40s : %5d time(s)\n", $client, $discardRequest{$client};
+ }
+}
+
+if ($killedChilds) {
+ printf "\n%-42s : %5d time(s)\n", "Killed Childs (taking too much time)", $killedChilds;
+}
+
+if (%warnings) {
+ print "\nWarnings:\n";
+ foreach my $warning (keys %warnings) {
+ my $components = $warnings{$warning};
+ printf " %-40s\n", "$warning in component:";
+ foreach my $component (keys %$components) {
+ printf " %-38s : %5d time(s)\n", $component, $components->{$component};
+ }
+ }
+}
+
if (keys %OtherList) {
print "\n**** Unmatched entries ****\n";
foreach (keys %OtherList) {
This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.
------------------------------------------------------------------------------
Get your SQL database under version control now!
Version control is standard for application code, but databases havent
caught up. So what steps can you take to put your SQL databases under
version control? Why should you start doing it? Read more to find out.
http://pubads.g.doubleclick.net/gampad/clk?id=49501711&iu=/4140/ostg.clktrk