Looking for unprocessed log entries
Orion Poplawski <[email protected]> Fri, 26 Sep 2014 15:30:08 -0600
| Newsgroups | gmane.comp.log.logwatch.devel |
|---|---|
| Message-ID | <[email protected]> |
One deficiency in logwatch is that only process output for services that knows about. If a new service is added to the system and has problem, logwatch will remain silent. I started working on a method of trying to see which messages are not being processed by logwatch and reporting those. An initial attempt is attached. This approach is currently hindered by the iptables and pam_unix scripts which do their filtering in script rather than via config file. Disabling those, I found the following services on my Fedora 20 machine: ModemManager NetworkManager NetworkManagerDispatcher abrtd accounts-daemon acpid akmods alsactl audispd avahi-daemon bluetoothd chronyd colord dbus dbus-daemon dhclient dnsmasq dnsmasq-dhcp dracut-cmdline firefox journal kcheckpass kdm mtp-probe nfsidmap nm-dispatcher.action polkitd pulseaudio rc.local rngd rpc.statd rpcbind rsyslogd rtkit-daemon sm-notify su sysctl systemd systemd-cgroups-agent systemd-fsck systemd-journald systemd-logind systemd-modules-load systemd-readahead systemd-udevd udisksd xinetd I am also thinking though that we really should be moving to using the journal and different method of filtering. More later hopefully... - Orion -- Orion Poplawski Technical Manager 303-415-9701 x222 NWRA, Boulder/CoRA Office FAX: 303-415-9702 3380 Mitchell Lane [email protected] Boulder, CO 80301 http://www.nwra.com ------------------------------------------------------------------------------ Meet PCI DSS 3.0 Compliance Requirements with EventLog Analyzer Achieve PCI DSS 3.0 Compliant Status with Out-of-the-box PCI DSS Reports Are you Audit-Ready for PCI DSS 3.0 Compliance? Download White paper Comply to PCI DSS 3.0 Requirement 10 and 11.5 with EventLog Analyzer http://pubads.g.doubleclick.net/gampad/clk?id=154622311&iu=/4140/ostg.clktrk _______________________________________________ Logwatch-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/logwatch-devel
logwatch-unmatched.patch
(text/x-patch, 4.7 KB)
Index: scripts/logwatch.pl
===================================================================
--- scripts/logwatch.pl (revision 256)
+++ scripts/logwatch.pl (working copy)
@@ -913,6 +913,37 @@
parselogs();
}
+
+foreach $LogFile (@LogFileList) {
+ next if ($LogFile eq 'none');
+
+ my $LogFileName = $TempDir . $LogFile;
+ next unless -f "$LogFileName";
+ my $MatchedFileText = $LogFileName . "-matched";
+ my $UnmatchedFileText = $LogFileName . "-unmatched";
+ my $Command = "";
+ if (-s $MatchedFileText) {
+ $Command = "grep -Fvf $MatchedFileText $LogFileName > $UnmatchedFileText";
+ } else {
+ $Command = "ln $LogFileName $UnmatchedFileText";
+ }
+ if ($Config{'debug'}>4) {
+ print "\nChecking for unmatched entries in LogFile: " . $LogFile . "\n" . $Command . "\n";
+ }
+ if ($LogFile !~ /^[-_\w\d]+$/) {
+ print STDERR "Unexpected filename: [[$LogFile]]. Not used\n"
+ } else {
+ #System call does the log processing
+ system("$Command");
+ #or die "system '$Command' failed: $?"
+ }
+ if (-s $UnmatchedFileText) {
+ print "Unmatched entries in $LogFile:\n";
+ #system("$Config{'pathtocat'} $UnmatchedFileText");
+ system("awk '{print \$5}' $UnmatchedFileText| sed -e 's/\[[0-9]*\]//' -e s/:// |sort -u");
+ }
+}
+
#Close Filehandle is needed -mgt
close(OUTFILE) unless ($Config{'output'} eq "stdout");
#############################################################################
@@ -1263,9 +1294,16 @@
my $FileText = "";
foreach $ThisFile (@FileList) {
if (-s $TempDir . $ThisFile) {
- $FileText .= ( $TempDir . $ThisFile . " ");
+ $FileText .= ($TempDir . $ThisFile . " ");
}
}
+ # Trim final space
+ $FileText =~ s/ *$//;
+ # If we only process a single log file, we can use tee to generate the matched file
+ my $MatchedFile = "";
+ if ($FileText and $FileText !~ / /) {
+ $MatchedFile = $FileText . "-matched";
+ }
# remove the ENV entries set by previous service
foreach my $Parm (@EnvList) {
@@ -1273,17 +1311,28 @@
}
@EnvList = ();
- my $FilterText = " ";
+ my $FilterText = "";
+ my $ServiceFilter = "";
foreach (sort keys %{$ServiceData{$Service}}) {
my $cmd = $_;
if ($cmd =~ s/^\d+-\*//) {
+ my $CmdPath = "";
if (-f "$ConfigDir/scripts/shared/$cmd") {
- $FilterText .= ("$PerlVersion $ConfigDir/scripts/shared/$cmd '$ServiceData{$Service}{$_}' |" );
+ $CmdPath="$ConfigDir/scripts/shared/$cmd";
} elsif (-f "$BaseDir/scripts/shared/$cmd") {
- $FilterText .= ("$PerlVersion $BaseDir/scripts/shared/$cmd '$ServiceData{$Service}{$_}' |" );
+ $CmdPath="$BaseDir/scripts/shared/$cmd";
} else {
die "Cannot find shared script $cmd\n";
}
+ $FilterText .= "$PerlVersion $CmdPath '$ServiceData{$Service}{$_}' |";
+ if ($cmd =~ /service/) {
+ # If we only process a single log file, we can use tee to generate the matched file
+ if ($FileText and $FileText !~ / /) {
+ $FilterText .= "tee -a $MatchedFile ${MatchedFile}-$Service |";
+ } else {
+ $ServiceFilter = "| $PerlVersion $CmdPath '$ServiceData{$Service}{$_}'";
+ }
+ }
} elsif ($cmd =~ s/^\$//) {
$ENV{$cmd} = $ServiceData{$Service}{$_};
push @EnvList, $cmd;
@@ -1292,6 +1341,14 @@
}
}
}
+ # If we didn't find a service filter, use tee
+ if ($ServiceFilter eq "" and $FilterText !~ /tee -a/ and $MatchedFile) {
+ $FilterText .= "tee -a $MatchedFile ${MatchedFile}-$Service |";
+ }
+ if ($Config{'debug'}>9) {
+ print "ServiceFilter=$ServiceFilter\n";
+ }
+
# ECP - insert the host stripping now
my $HostStrip = " ";
if ($Config{'hostformat'} ne "none") { #8.0
@@ -1389,6 +1446,17 @@
}
&output( $index_par, "\n", "stop");
}
+ # If we are parsing more than one log file, we need to process matches for each
+ if ($FileText =~ / /) {
+ foreach my $MatchLogFile (split(/ /,$FileText)) {
+ $MatchedFile = $MatchLogFile . "-matched";
+ if ($Config{'debug'}>4) {
+ print "\nProcessing matched $Config{'pathtocat'} $MatchLogFile $ServiceFilter >> $MatchedFile\n";
+ }
+ system("$Config{'pathtocat'} $MatchLogFile $ServiceFilter >> $MatchedFile");
+ system("$Config{'pathtocat'} $MatchLogFile $ServiceFilter >> ${MatchedFile}-${Service}");
+ }
+ }
}
}