Logwatch Chokes on Proftpd's Extended Logs

Hello list,

I've just discovered that Logwatch was not parsing the extended logs available in Proftpd. If anyone could comment on it at all I would highly appreciate it.

Proftpd has extra logs to turn on in its .conf. For example:

ExtendedLog /var/log/proftpd/access.log WRITE,READ write
ExtendedLog /var/log/proftpd/auth.log AUTH auth

Now when you feed them to Logwacth by adding these extra log files like this:

LogFile = /var/log/proftpd/proftpd.log 
LogFile = /var/log/proftpd/access.log
LogFile = /var/log/proftpd/auth.log

it won't process the log files if *OnlyService = proftpd is enabled or it chokes down and outputs lots of sshd entries along with entire access.log and auth.log files simply copy-pasted via unmatched entries if #*OnlyService = proftpd is disabled.

The only log file that is processed correctly is proftpd.log. Not sure if it's limited for a reason but I think parsing these two extra proftpd's log files would be also nice. Would be thankful for any comments here at all.

Here are some extracts from access.log produced by proftpd:

213.221.131.200 UNKNOWN proftpd [31/Mar/2015:11:09:10 +0300] "HOST ftp.domainname.com" 550 -
213.221.131.200 UNKNOWN proftpd [31/Mar/2015:12:15:09 +0300] "HOST ftp.domainname.com" 550 -
213.221.131.200 UNKNOWN proftpd [31/Mar/2015:12:15:09 +0300] "HOST ftp.domainname.com" 550 -
213.221.131.200 UNKNOWN proftpd [31/Mar/2015:13:18:24 +0300] "HOST ftp.domainname.com" 550 -
213.221.131.200 UNKNOWN proftpd [31/Mar/2015:13:18:24 +0300] "HOST ftp.domainname.com" 550 -

and from auth.log generated by proftpd:

Google [32214] 74.125.198.99  [03/Apr/2015:10:08:56 +0300] "USER admin" 331
Google [32178] 74.125.198.99 [03/Apr/2015:10:05:35 +0300] "PASS (hidden)" 230
Google [32214] 74.125.198.99 [03/Apr/2015:10:08:56 +0300] "USER admin" 331
Google [32214] 74.125.198.99 [03/Apr/2015:10:08:56 +0300] "PASS (hidden)" 230
Google [32280] 74.125.198.99 [03/Apr/2015:10:09:51 +0300] "USER admin" 331
Google [32280] 74.125.198.99 [03/Apr/2015:10:09:51 +0300] "PASS (hidden)" 230

Many thanks!

Regards,
Dennis.

------------------------------------------------------------------------------
Dive into the World of Parallel Programming The Go Parallel Website, sponsored
by Intel and developed in partnership with Slashdot Media, is your hub for all
things parallel software development, from weekly thought leadership blogs to
news, videos, case studies, tutorials and more. Take a look and join the 
conversation now. http://goparallel.sourceforge.net/

_______________________________________________
Logwatch-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/logwatch-devel