patch for 7.4.1 audit script
Tom Shield <[email protected]> Mon, 11 Jan 2016 20:44:40 -0600
| Newsgroups | gmane.comp.log.logwatch.devel |
|---|---|
| Message-ID | <CAPmqS2weHy4sLKxqM6NWRCZW+9dAnOE9uK0ZkJgGOQPX1zf8HA@mail.gmail.com> |
Hello, Attached is a patch to 7.4.1 to get rid of the excess (I get 100's) success messages in the audit section. This was tested on Fedora 22: logwatch-7.4.1-5.20150731svn293.fc22.noarch thanks, Tom -- Tom Shield [email protected] Vadnais Heights, MN "... and may you never make the mistake of believing you know all there is about sailing." John Rousmaniere, *Annapolis Book of Seamanship* ------------------------------------------------------------------------------ Site24x7 APM Insight: Get Deep Visibility into Application Performance APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month Monitor end-to-end web transactions and take corrective actions now Troubleshoot faster and improve end-user experience. Signup Now! http://pubads.g.doubleclick.net/gampad/clk?id=267308311&iu=/4140 _______________________________________________ Logwatch-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/logwatch-devel
logwatch-7.4.1-audit.patch
(text/x-patch, 999 B)
--- /usr/share/logwatch/scripts/services/audit 2015-08-25 04:11:11.000000000 -0500
+++ audit 2016-01-10 16:54:36.380889740 -0600
@@ -91,6 +91,7 @@
my $NumberOfDdStops = 0;
my $NumberOfAllowedMessages = 0;
my $NumberOfLostMessages = 0;
+my $NumberOfSuccesses = 0;
my %InvalidContext = ();
my %BugLog = ();
my $UELimit = 100;
@@ -136,6 +137,8 @@
( $ThisLine =~ /^auditctl(?:\[[0-9]+\])?: No rules$/ )
) {
# Ignore these entries
+ } elsif ( $ThisLine =~ /audit: .* res=success/) {
+ $NumberOfSuccesses++;
} elsif ( $ThisLine =~ /audit\([0-9]{10}.[0-9]{3}:[0-9]\): initialized$/) {
$NumberOfInits++;
} elsif ( $ThisLine =~ /Init complete, audit pid set to: [0-9]+/) {
@@ -293,6 +296,10 @@
print "\n Number of allowed messages: $NumberOfAllowedMessages\n";
}
+if ($NumberOfSuccesses) {
+ print "\n Number of Success messages: $NumberOfSuccesses\n";
+}
+
if ($NumberOfLostMessages) {
print "\n Number of lost messages: $NumberOfLostMessages\n";
}