PATCH for clamav-milter, dovecot, pam_unix and xntpd

diff --git a/scripts/services/clamav-milter b/scripts/services/clamav-milter
index fdb23ac..da4fd91 100755
--- a/scripts/services/clamav-milter
+++ b/scripts/services/clamav-milter
@@ -27,12 +27,15 @@ my $IgnoreUnmatched = $ENV{'clamav_ignoreunmatched'} || 0;
 
 while (defined($ThisLine = <STDIN>)) {
 
+   chomp($ThisLine);
    if (
        ( $ThisLine =~ /^clamav-milter (startup|shutdown) succeeded$/ ) or
+       ( $ThisLine =~ /^clamav-milter started at/i ) or
+       ( $ThisLine =~ /^(WARNING: )?No clamd server appears to be available/i ) or
        ( $ThisLine =~ /^Database has changed, loading updated database/ ) or
        ( $ThisLine =~ /^Quarantined infected mail as/ ) or
        ( $ThisLine =~ /^\w+ quarantined as/ ) or
-       ( $ThisLine =~ /^ClamAv: mi_stop/ ) or
+       ( $ThisLine =~ /^ClamAv: mi_stop/i ) or
        ( $ThisLine =~ m#^\/tmp\/clamav-.* .* FOUND# ) or
        # These two go along with "max-children limit" so we ignore them
        ( $ThisLine =~ /n_children \d+: waiting \d+ seconds for some to exit/ ) or

diff --git a/scripts/services/dovecot b/scripts/services/dovecot
index b5fcbfe..b45715b 100755
--- a/scripts/services/dovecot
+++ b/scripts/services/dovecot
@@ -151,7 +151,7 @@ while (defined($ThisLine = <STDIN>)) {
          # We don't care about these
      } elsif ( $ThisLine =~ /Killed with signal /) {
          $End++;
-     } elsif ( $ThisLine =~ /Dovecot (v\d[^ ]* |)starting up/) {
+     } elsif ( $ThisLine =~ /Dovecot (v\d[^ ]* |)(\([0-9a-fA-F]+\) )?starting up/) {
          $Restarts++;
          $End = 0;
      } elsif ( ( ($User, $Host) = ( $ThisLine =~ /^pop3-login: Login: (.*?) \[(.*)\]/ ) ) or
@@ -267,6 +267,8 @@ while (defined($ThisLine = <STDIN>)) {
       $Disconnected{$Reason}++;
    } elsif ($ThisLine =~ /Disconnected (bytes|top)=.*/) {
       $Disconnected{"No reason"}++;
+   } elsif (($Reason) = ($ThisLine =~ /(Logged out) (bytes|top|in)=.*/) ) {
+      $Disconnected{$Reason}++;
    } elsif ($ThisLine =~ /Server shutting down./) {
       $ConnectionCl{"Server shutting down"}++;
    } elsif (($Reason, $Host) = ($ThisLine =~ /TLS initialization failed/) ) {

diff --git a/scripts/services/pam_unix b/scripts/services/pam_unix
index 6d6f0fc..e06c817 100755
--- a/scripts/services/pam_unix
+++ b/scripts/services/pam_unix
@@ -163,7 +163,7 @@ while ($line = <STDIN>) {
    }
    #lowercase the service
    $service = lc($service);
-   if ( grep $_ eq $service, qw/ssh sshd login ftp vsftpd proftpd rsh remote rlogin rexec/) {
+   if ( grep $_ eq $service, qw/ssh sshd login ftp vsftpd proftpd rsh remote rlogin rexec systemd-user/) {
       if ($line =~ s/^session opened for user (.+) by \(uid=\d+\)/$1/) {
 	 ($Detail >= 5) && $data{$service}{'Sessions Opened'}{$line}++;
       } elsif ($line =~ s/^session opened for user ([^ ]*) by ([^ ]*)\(uid=\d+\)/$1 by $2/) {
@@ -198,7 +198,7 @@ while ($line = <STDIN>) {
       } else {
          $data{$service}{'Unknown Entries'}{$line}++;
       }
-   } elsif (grep $_ eq $service, qw/su sudo su-l/) {
+   } elsif (grep $_ eq $service, qw/su sudo su-l polkit-1/) {
       if ( my ($logname, $uid, $ruser, $user) = ($line =~ /^authentication failure; logname=(\S*)\s+uid=(\d+) (?:.*ruser=(\S*)\s+)?.*user=(\S*)$/)) {
          $line = ($logname or $ruser)."($uid) -> $user";
          $data{$service}{'Authentication Failures'}{$line}++;
@@ -228,8 +228,8 @@ while ($line = <STDIN>) {
       if ($line =~ s/^password changed for (.+)/$1/) {
          ($Detail >= 5) && $data{$service}{'Password changed'}{$line}++;
       }
-   } elsif (grep $_ eq $service, qw/gdm gdm-password gdm-welcome kdm kcheckpass xdm imap dovecot cups/) {
-      if ($line =~ s/^session opened for user (.+) by (?:\(unknown\))?\(uid=\d+\)/$1/) {
+   } elsif (grep $_ eq $service, qw/gdm gdm-password gdm-welcome gdm-launch-environment kdm kcheckpass xdm imap dovecot cups/) {
+      if ($line =~ s/^session opened for user (.+) by (?:\(unknown\)|\w+)?\(uid=\d+\)/$1/) {
          ($Detail >= 5) && $data{$service}{'Sessions Opened'}{$line}++;
       } elsif ($line =~ s/^authentication failure;.* user=(.+)$/$1/) {
          $data{$service}{'Authentication Failures'}{$line}++;

diff --git a/scripts/services/xntpd b/scripts/services/xntpd
index 0b96ea6..ffeead6 100644
--- a/scripts/services/xntpd
+++ b/scripts/services/xntpd
@@ -80,7 +80,7 @@ while (defined(my $ThisLine = <STDIN>)) {
         ($ThisLine =~ /Listening on interface .* Disabled/) or
         ($ThisLine =~ /Listen and drop on /) or
         ($ThisLine =~ /Listening on routing socket on/) or
-        ($ThisLine =~ /.* interface .* -> \(null\)/) or
+        ($ThisLine =~ /.* interface .* -> .*/) or
         ($ThisLine =~ /Deferring DNS for/) or
         ($ThisLine =~ /ntp_io: estimated max descriptors: \d*, initial socket boundary: \d*/) or
         ($ThisLine =~ /peers refreshed$/) or