SF.net SVN: logwatch:[260] trunk/scripts/services/audit

Revision: 260
          http://sourceforge.net/p/logwatch/code/260
Author:   opoplawski
Date:     2014-10-08 20:34:27 +0000 (Wed, 08 Oct 2014)
Log Message:
-----------
[audit] Ignore more lines; Handle auditctl with pid; More warning messages and cleaner report

Modified Paths:
--------------
    trunk/scripts/services/audit

Modified: trunk/scripts/services/audit
===================================================================
--- trunk/scripts/services/audit	2014-10-06 15:40:43 UTC (rev 259)
+++ trunk/scripts/services/audit	2014-10-08 20:34:27 UTC (rev 260)
@@ -129,9 +129,11 @@
         ( $ThisLine =~ /type=[0-9]+ audit\([0-9.]*:[0-9]*\): pid=[0-9]* uid=0 old auid=[0-9]* new auid=[0-9]+ old ses=[0-9]* new ses=[0-9]+ res=1$/) or
         ( $ThisLine =~ /type=[0-9]+ audit\([0-9.]*:[0-9]*\):  cwd=".*"/) or
         ( $ThisLine =~ /type=[0-9]+ audit\([0-9.]*:[0-9]*\): user/) or
+        ( $ThisLine =~ /type=[0-9]+ audit\([0-9.]*:[0-9]*\): proctitle=/) or
+        ( $ThisLine =~ /type=[0-9]+ audit\([0-9.]*:[0-9]*\): table=/) or
         ( $ThisLine =~ /audit_printk_skb: [0-9]* callbacks suppressed/) or
 	( $ThisLine =~ /item=[0-9] name="\S*" inode=[0-9]+ dev=\S* mode=[0-9]* ouid=[0-9]* ogid=[0-9]* rdev=[0-9:]* obj=\S*/) or
-	( $ThisLine =~ /^auditctl: No rules$/ )
+	( $ThisLine =~ /^auditctl(?:\[[0-9]+\])?: No rules$/ )
     ) {
 	# Ignore these entries
     } elsif ( $ThisLine =~ /audit\([0-9]{10}.[0-9]{3}:[0-9]\): initialized$/) {
@@ -153,12 +155,13 @@
 	     ( $ThisLine =~ /major=[0-9]+ name_count=[0-9]+: freeing multiple contexts \([1-2]\)/)) {
       $ThisLine =~ s/audit\(:[0-9]+\): //;
       $BugLog{$ThisLine}++;
-    } elsif (( $ThisLine =~ /Audit daemon is low on disk space for logging/)  or
-             ( $ThisLine =~ /Audit daemon is suspending logging due to low disk space./)) {
-      $Warning{$ThisLine}++;
+    } elsif (( $ThisLine =~ /(Audit daemon is low on disk space for logging.*)/) or
+             ( $ThisLine =~ /(Audit daemon has no space left.*)/) or
+             ( $ThisLine =~ /(Audit daemon is suspending logging due to.*)/)) {
+      $Warning{$1}++;
     } elsif ( my ($status) = ( $ThisLine =~ /AUDIT_STATUS: (.*)/ ) ) {
       $AuditctlStatus{$status}++; 
-    } elsif ( my ($status) = ( $ThisLine =~ /^auditctl: (.*)/ ) ) {
+    } elsif ( my ($status) = ( $ThisLine =~ /^auditctl(?:\[[0-9]+\])?: (.*)/ ) ) {
       $AuditctlStatus{$status}++; 
     } elsif ( $ThisLine =~ /audit\([0-9]+\.[0-9]+:[0-9]+\): apparmor=/) {
         # AppArmor

This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.


------------------------------------------------------------------------------
Meet PCI DSS 3.0 Compliance Requirements with EventLog Analyzer
Achieve PCI DSS 3.0 Compliant Status with Out-of-the-box PCI DSS Reports
Are you Audit-Ready for PCI DSS 3.0 Compliance? Download White paper
Comply to PCI DSS 3.0 Requirement 10 and 11.5 with EventLog Analyzer
http://pubads.g.doubleclick.net/gampad/clk?id=154622311&iu=/4140/ostg.clktrk