Re: Proftpd-Messages Unmatched Entries

Hello Orion,

Thank you for replying.

Well, I have custom paths and point to them. /etc/logwatch/conf/logfiles/myproftpd.conf  has only one line in it like this LogFile = /var/log/proftpd/proftpd.log

Now, this is the only file that gets parsed. The /var/log/proftpd/auth.log is not read by Logwatch at all because I receive all the contents from it in a form of a mere copy-paste, just complete, entire copy-pasted file. Plus, I do not have any secure and authlog files at all. Messages file in Debian exist but this file is not used for proftpd at all (I guess), messages file uses rsyslog by default, not syslogd and the lines rsyslog.. etc. I get are from messages file. Not sure how it reads them from there anyway as I pointed Logwatch to the only logfile mentioned above, that is to proftpd.log

Default Debian configuration does not see proftpd-messages script at all, not a single line is reported in your daily Logwatch mail before you set / configure it manually first yourself.

I tried it with *OnlyService = proftpd being on and off but the results are the same because the script reads (I guess) or at least it is supposed to read only my proftpd.log file as declared in /etc/logwatch/conf/logfiles/myproftpd.conf

My 
# Which logfile group...
LogFile = messages
LogFile = secure


has only this:
# Which logfile group...
# LogFile = messages
LogFile = myproftpd

but nonetheless messages file is "fed" to logwatch for parsing and I get its results in unmatched entries... 

I saw push @OtherList,$ThisLine being there in the script but I am not that good at perl and normally I declare variables in php like this:   $servertime = date(" G:i:s") . " server's time "; where $servertime is a variable itself and the data after = is what the variable holds. That is I was looking for the data the variable @OtherList held...


Regards,
Dennis.

 

From: Orion Poplawski 
Sent: Monday, August 4, 2014 19:18
To: Klaipedaville on Google ; [email protected] 
Subject: Re: [Logwatch-devel] Proftpd-Messages Unmatched Entries

On 08/02/2014 10:15 AM, Klaipedaville on Google wrote:
> Hello,
> I would be really thankful if someone could give me a few pointers on
> proftpd-messages script of Logwatch 7.4.0 (11/08/13) run on Debian Wheezy
> stable. I’ll try to be concise.
> 1. I receive unmatched entries in my Logwatch daily mail that do hot have
> anything to do with proftpd at all, for example these are copy-pasted real lines:
> origin software="rsyslogd" swVersion="5.8.11" x-pid="2013"
> x-info="http://www.rsyslog.com"] rsyslogd was HUPed
> postgres (24373): /proc/24373/oom_adj is deprecated, please use
> /proc/24373/oom_score_adj instead
> warning: /etc/hosts.deny, line 138: can't verify hostname:
> getaddrinfo(212.51.174.61.dial.wz.zj.dynamic.163data.com.cn, AF_INET)
> I went through my proftpd log file that is "fed" to logwatch for parsing and
> it does not have anything like above-mentioned lines at all. Where does the
> script take these lines from? The proftpd's log file looks like this:

I don't run Debian, but:

The default logwatch configuration for proftpd-messages 
(/usr/share/logwatch/default.conf/services/proftpd-messages.conf) has:

# Which logfile group...
LogFile = messages
LogFile = secure

So it is going to parse /var/log/messages and 
/var/log/{secure,authlog,auth.log} by default.  If you have a separate proftpd 
logfile, logwatch will need to be pointed to it.  If this is a default debian 
config, this should be done automatically by Debian's logwatch package.  If 
not, I'd file a bug in Debian.

That said, logwatch should filter out those other messages via:

*OnlyService = proftpd

so I'm not sure why you are seeing them.  Are there any proftpd config files 
in /etc/logwatch?

> 3. Could you please, also advise the place where is the data for @OtherList
> variable declared? If I find it I may try to re-code it myself to fix my issues.
> I would highly appreciate any comments, suggestions, advices or any other help
> or assistance at all. Many thanks in advance!

In /usr/share/logwatch/scripts/services/proftpd-messages:

    } else {
       # Report any unmatched entries...
       push @OtherList,$ThisLine;
    }


-- 
Orion Poplawski
Technical Manager                     303-415-9701 x222
NWRA, Boulder/CoRA Office             FAX: 303-415-9702
3380 Mitchell Lane                       [email protected]
Boulder, CO 80301                   http://www.nwra.com

------------------------------------------------------------------------------
Infragistics Professional
Build stunning WinForms apps today!
Reboot your WinForms applications with our WinForms controls. 
Build a bridge from your legacy apps to the future.
http://pubads.g.doubleclick.net/gampad/clk?id=153845071&iu=/4140/ostg.clktrk

_______________________________________________
Logwatch-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/logwatch-devel