SF.net SVN: logwatch:[253] trunk/scripts/services/secure

Revision: 253
          http://sourceforge.net/p/logwatch/code/253
Author:   opoplawski
Date:     2014-09-25 18:49:36 +0000 (Thu, 25 Sep 2014)
Log Message:
-----------
[secure] RootkitHunter support.

Author: Jan Synacek <[email protected]>
RH-Bugzilla: #818926

Modified Paths:
--------------
    trunk/scripts/services/secure

Modified: trunk/scripts/services/secure
===================================================================
--- trunk/scripts/services/secure	2014-09-25 18:37:00 UTC (rev 252)
+++ trunk/scripts/services/secure	2014-09-25 18:49:36 UTC (rev 253)
@@ -180,6 +180,7 @@
 $PwdChange = 0;
 $RequestKeyFailures = 0;
 %OtherList = ();
+%RootkitHunter = ();
 use Logwatch ':ip';
 
 while (defined($ThisLine = <STDIN>)) {
@@ -527,6 +528,14 @@
         $e='';
      }
      $KerbList{$response}{$type}{$from}{$service}{$client}{$e}++;
+   } elsif ($ThisLine =~ /Rootkit Hunter:/ ) {
+      if ($ThisLine =~ /Please inspect this machine/) {
+         $RootkitHunter{'inspect'}++;
+      } elsif ($ThisLine =~ /check started/) {
+         $RootkitHunter{'runs'}++;
+      } elsif (my ($mins, $secs) = ($ThisLine =~ /Scanning took ([0-9]*) minutes? and ([0-9]*) seconds?/)) {
+         $RootkitHunter{'time'}+= $mins*60 + $secs;
+      }
    } else {
       # Unmatched entries...
       $ThisLine =~ s/\[\d+\]:/:/;
@@ -920,6 +929,15 @@
    }
 }
 
+if (keys %RootkitHunter) {
+   use integer;
+   my ($mins, $secs) = ($RootkitHunter{'time'} / 60, $RootkitHunter{'time'} % 60);
+   print "\nRootkitHunter:\n";
+   print "   Runs: $RootkitHunter{'runs'}\n";
+   print "   Suggested Inspection: $RootkitHunter{'inspect'} Time(s)\n";
+   print "   Total Runtime: $mins minute(s) $secs second(s)\n";
+}
+
 if (keys %OtherList) {
    print "\n**Unmatched Entries**\n";
    foreach $line (sort {$a cmp $b} keys %OtherList) {

This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.


------------------------------------------------------------------------------
Meet PCI DSS 3.0 Compliance Requirements with EventLog Analyzer
Achieve PCI DSS 3.0 Compliant Status with Out-of-the-box PCI DSS Reports
Are you Audit-Ready for PCI DSS 3.0 Compliance? Download White paper
Comply to PCI DSS 3.0 Requirement 10 and 11.5 with EventLog Analyzer
http://pubads.g.doubleclick.net/gampad/clk?id=154622311&iu=/4140/ostg.clktrk