Looking for unprocessed log entries

Orion Poplawski <[email protected]> Fri, 26 Sep 2014 15:30:08 -0600
Newsgroups gmane.comp.log.logwatch.devel
Message-ID <[email protected]>
One deficiency in logwatch is that only process output for services that knows 
about.  If a new service is added to the system and has problem, logwatch will 
remain silent.

I started working on a method of trying to see which messages are not being 
processed by logwatch and reporting those.  An initial attempt is attached.

This approach is currently hindered by the iptables and pam_unix scripts which 
do their filtering in script rather than via config file.

Disabling those, I found the following services on my Fedora 20 machine:

ModemManager
NetworkManager
NetworkManagerDispatcher
abrtd
accounts-daemon
acpid
akmods
alsactl
audispd
avahi-daemon
bluetoothd
chronyd
colord
dbus
dbus-daemon
dhclient
dnsmasq
dnsmasq-dhcp
dracut-cmdline
firefox
journal
kcheckpass
kdm
mtp-probe
nfsidmap
nm-dispatcher.action
polkitd
pulseaudio
rc.local
rngd
rpc.statd
rpcbind
rsyslogd
rtkit-daemon
sm-notify
su
sysctl
systemd
systemd-cgroups-agent
systemd-fsck
systemd-journald
systemd-logind
systemd-modules-load
systemd-readahead
systemd-udevd
udisksd
xinetd


I am also thinking though that we really should be moving to using the journal 
and different method of filtering.  More later hopefully...

- Orion

-- 
Orion Poplawski
Technical Manager                     303-415-9701 x222
NWRA, Boulder/CoRA Office             FAX: 303-415-9702
3380 Mitchell Lane                       [email protected]
Boulder, CO 80301                   http://www.nwra.com

------------------------------------------------------------------------------
Meet PCI DSS 3.0 Compliance Requirements with EventLog Analyzer
Achieve PCI DSS 3.0 Compliant Status with Out-of-the-box PCI DSS Reports
Are you Audit-Ready for PCI DSS 3.0 Compliance? Download White paper
Comply to PCI DSS 3.0 Requirement 10 and 11.5 with EventLog Analyzer
http://pubads.g.doubleclick.net/gampad/clk?id=154622311&iu=/4140/ostg.clktrk

_______________________________________________
Logwatch-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/logwatch-devel
logwatch-unmatched.patch (text/x-patch, 4.7 KB)
Index: scripts/logwatch.pl
===================================================================
--- scripts/logwatch.pl	(revision 256)
+++ scripts/logwatch.pl	(working copy)
@@ -913,6 +913,37 @@
    parselogs();
 }
 
+
+foreach $LogFile (@LogFileList) {
+   next if ($LogFile eq 'none');
+
+   my $LogFileName = $TempDir . $LogFile;
+   next unless -f "$LogFileName";
+   my $MatchedFileText = $LogFileName . "-matched";
+   my $UnmatchedFileText = $LogFileName . "-unmatched";
+   my $Command = "";
+   if (-s $MatchedFileText) {
+      $Command = "grep -Fvf $MatchedFileText $LogFileName > $UnmatchedFileText";
+   } else {
+      $Command = "ln $LogFileName $UnmatchedFileText";
+   }
+   if ($Config{'debug'}>4) {
+      print "\nChecking for unmatched entries in LogFile: " . $LogFile . "\n" . $Command . "\n";
+   }
+   if ($LogFile !~ /^[-_\w\d]+$/) {
+      print STDERR "Unexpected filename: [[$LogFile]]. Not used\n"
+   } else {
+      #System call does the log processing
+      system("$Command");
+         #or die "system '$Command' failed: $?"
+   }
+   if (-s $UnmatchedFileText) {
+      print "Unmatched entries in $LogFile:\n";
+      #system("$Config{'pathtocat'} $UnmatchedFileText");
+      system("awk '{print \$5}' $UnmatchedFileText| sed -e 's/\[[0-9]*\]//' -e s/:// |sort -u");
+   }
+}
+
 #Close Filehandle is needed -mgt
 close(OUTFILE) unless ($Config{'output'} eq "stdout");
 #############################################################################
@@ -1263,9 +1294,16 @@
       my $FileText = "";
       foreach $ThisFile (@FileList) {
          if (-s $TempDir . $ThisFile) {
-            $FileText .= ( $TempDir . $ThisFile . " ");
+            $FileText .= ($TempDir . $ThisFile . " ");
          }
       }
+      # Trim final space
+      $FileText =~ s/ *$//;
+      # If we only process a single log file, we can use tee to generate the matched file
+      my $MatchedFile = "";
+      if ($FileText and $FileText !~ / /) {
+         $MatchedFile = $FileText . "-matched";
+      }
 
       # remove the ENV entries set by previous service
       foreach my $Parm (@EnvList) {
@@ -1273,17 +1311,28 @@
       }
       @EnvList = ();
 
-      my $FilterText = " ";
+      my $FilterText = "";
+      my $ServiceFilter = "";
       foreach (sort keys %{$ServiceData{$Service}}) {
          my $cmd = $_;
          if ($cmd =~ s/^\d+-\*//) {
+            my $CmdPath = "";
             if (-f "$ConfigDir/scripts/shared/$cmd") {
-               $FilterText .= ("$PerlVersion $ConfigDir/scripts/shared/$cmd '$ServiceData{$Service}{$_}' |" );
+               $CmdPath="$ConfigDir/scripts/shared/$cmd";
             } elsif (-f "$BaseDir/scripts/shared/$cmd") {
-               $FilterText .= ("$PerlVersion $BaseDir/scripts/shared/$cmd '$ServiceData{$Service}{$_}' |" );
+               $CmdPath="$BaseDir/scripts/shared/$cmd";
             } else {
                die "Cannot find shared script $cmd\n";
             }
+            $FilterText .= "$PerlVersion $CmdPath '$ServiceData{$Service}{$_}' |";
+            if ($cmd =~ /service/) {
+               # If we only process a single log file, we can use tee to generate the matched file
+               if ($FileText and $FileText !~ / /) {
+                  $FilterText .= "tee -a $MatchedFile ${MatchedFile}-$Service |";
+               } else {
+                  $ServiceFilter = "| $PerlVersion $CmdPath '$ServiceData{$Service}{$_}'";
+               }
+            }
          } elsif ($cmd =~ s/^\$//) {
             $ENV{$cmd} = $ServiceData{$Service}{$_};
             push @EnvList, $cmd;
@@ -1292,6 +1341,14 @@
             }
          }
       }
+      # If we didn't find a service filter, use tee
+      if ($ServiceFilter eq "" and $FilterText !~ /tee -a/ and $MatchedFile) {
+         $FilterText .= "tee -a $MatchedFile ${MatchedFile}-$Service |";
+      }
+      if ($Config{'debug'}>9) {
+         print "ServiceFilter=$ServiceFilter\n";
+      }
+
       # ECP - insert the host stripping now
       my $HostStrip = " ";
       if ($Config{'hostformat'} ne "none") { #8.0
@@ -1389,6 +1446,17 @@
             }
             &output( $index_par, "\n", "stop");
          }
+         # If we are parsing more than one log file, we need to process matches for each
+         if ($FileText =~ / /) {
+            foreach my $MatchLogFile (split(/ /,$FileText)) {
+               $MatchedFile = $MatchLogFile . "-matched";
+               if ($Config{'debug'}>4) {
+                  print "\nProcessing matched $Config{'pathtocat'} $MatchLogFile $ServiceFilter >> $MatchedFile\n";
+               }
+               system("$Config{'pathtocat'} $MatchLogFile $ServiceFilter >> $MatchedFile");
+               system("$Config{'pathtocat'} $MatchLogFile $ServiceFilter >> ${MatchedFile}-${Service}");
+            }
+         }
       }
    }