SF.net SVN: logwatch:[202] scripts/services/evtsecurity

Revision: 202
          http://sourceforge.net/p/logwatch/code/202
Author:   opoplawski
Date:     2014-07-18 17:52:11 +0000 (Fri, 18 Jul 2014)
Log Message:
-----------
[evtsecurity] Summarize some errors

Modified Paths:
--------------
    scripts/services/evtsecurity

Modified: scripts/services/evtsecurity
===================================================================
--- scripts/services/evtsecurity	2014-07-18 17:05:39 UTC (rev 201)
+++ scripts/services/evtsecurity	2014-07-18 17:52:11 UTC (rev 202)
@@ -52,7 +52,13 @@
       $SuccessAuditUsers{$UserName}++;
    }
    elsif ($EventLogType eq "Failure Audit") {
-      $FailureAudits{"$Hostname $ExpandedString"}++;
+      if (($account,$domain,$reason) = ($ExpandedString =~ /^An account failed to log on\..*Account For Which Logon Failed:.*Account Name:\s+(\S+)\s+Account Domain:\s+(\S+).*Failure Reason:\s+(.+)\s+Status:.*Sub Status:/)) {
+         $FailureAudits{"$Hostname Log On Failure for $domain\\$account: $reason"}++;
+      } elsif (($account,$domain,$process) = ($ExpandedString =~ /^A privileged service was called\..*Account Name:\s+(\S+)\s+Account Domain:\s+(\S+).*Process Name:\s+(.+)\sService/)) {
+         $FailureAudits{"$Hostname Privileged service called for $domain\\$account: $process"}++ if $Detail;
+      } else {
+         $FailureAudits{"$Hostname $ExpandedString"}++;
+      }
    }
    else {
       # Report any unmatched entries...
@@ -70,7 +76,7 @@
 
 if (keys %FailureAudits) {
    print "\nFailure Audits\n";
-   foreach $Error (keys %FailureAudits) {
+   foreach $Error (sort keys %FailureAudits) {
       print "    $Error : $FailureAudits{$Error} Times\n";
    }
 }

This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.


------------------------------------------------------------------------------
Want fast and easy access to all the code in your enterprise? Index and
search up to 200,000 lines of code with a free copy of Black Duck
Code Sight - the same software that powers the world's largest code
search on Ohloh, the Black Duck Open Hub! Try it now.
http://p.sf.net/sfu/bds