Re: Proftpd-Messages Unmatched Entries

On 08/02/2014 10:15 AM, Klaipedaville on Google wrote:
> Hello,
> I would be really thankful if someone could give me a few pointers on
> proftpd-messages script of Logwatch 7.4.0 (11/08/13) run on Debian Wheezy
> stable. I’ll try to be concise.
> 1. I receive unmatched entries in my Logwatch daily mail that do hot have
> anything to do with proftpd at all, for example these are copy-pasted real lines:
> origin software="rsyslogd" swVersion="5.8.11" x-pid="2013"
> x-info="http://www.rsyslog.com"] rsyslogd was HUPed
> postgres (24373): /proc/24373/oom_adj is deprecated, please use
> /proc/24373/oom_score_adj instead
> warning: /etc/hosts.deny, line 138: can't verify hostname:
> getaddrinfo(212.51.174.61.dial.wz.zj.dynamic.163data.com.cn, AF_INET)
> I went through my proftpd log file that is "fed" to logwatch for parsing and
> it does not have anything like above-mentioned lines at all. Where does the
> script take these lines from? The proftpd's log file looks like this:

I don't run Debian, but:

The default logwatch configuration for proftpd-messages 
(/usr/share/logwatch/default.conf/services/proftpd-messages.conf) has:

# Which logfile group...
LogFile = messages
LogFile = secure

So it is going to parse /var/log/messages and 
/var/log/{secure,authlog,auth.log} by default.  If you have a separate proftpd 
logfile, logwatch will need to be pointed to it.  If this is a default debian 
config, this should be done automatically by Debian's logwatch package.  If 
not, I'd file a bug in Debian.

That said, logwatch should filter out those other messages via:

*OnlyService = proftpd

so I'm not sure why you are seeing them.  Are there any proftpd config files 
in /etc/logwatch?

> 3. Could you please, also advise the place where is the data for @OtherList
> variable declared? If I find it I may try to re-code it myself to fix my issues.
> I would highly appreciate any comments, suggestions, advices or any other help
> or assistance at all. Many thanks in advance!

In /usr/share/logwatch/scripts/services/proftpd-messages:

    } else {
       # Report any unmatched entries...
       push @OtherList,$ThisLine;
    }


-- 
Orion Poplawski
Technical Manager                     303-415-9701 x222
NWRA, Boulder/CoRA Office             FAX: 303-415-9702
3380 Mitchell Lane                       [email protected]
Boulder, CO 80301                   http://www.nwra.com

------------------------------------------------------------------------------
Infragistics Professional
Build stunning WinForms apps today!
Reboot your WinForms applications with our WinForms controls. 
Build a bridge from your legacy apps to the future.
http://pubads.g.doubleclick.net/gampad/clk?id=153845071&iu=/4140/ostg.clktrk