Logwatch Exim script.
Jim Morgan <jim-pQf+s/KoLFFWk0Htik3J/[email protected]> Fri, 24 Feb 2017 12:21:48 +0800
| Newsgroups | gmane.comp.log.logwatch.devel |
|---|---|
| Organization | Datalude |
| Message-ID | <[email protected]> |
Hi, I'm running: exim4 --version Exim version 4.86_2 #1 built 05-Jan-2017 13:29:10 lsb_release -d Description: Ubuntu 16.04.2 LTS logwatch --version Logwatch 7.4.2 (released 02/27/16) Id tag from scripts/services/exim # $Id: exim 327 2016-02-20 21:54:54Z stefjakobs $ I run logwatch on detail level 5, and I'm seeing a lot of entries in the **Unmatched Entries** section which I believe should be incorporated into the main count. There are two types of errors in particular which occur frequently. eg 1) 2017-02-23 20:10:12 dovecot_login authenticator failed for (USER) [94.102.60.82]: 535 Incorrect authentication data (set_id=test-9IKiO1iGCm/[email protected]): 1 Time(s) 2) 2017-02-23 20:32:44 H=(1.2.3.4) [37.32.45.1] rejected MAIL <[email protected]>: Access denied - Invalid HELO name (See RFC2821 4.1.3): 1 Time(s) I believe the first of these should be summarised somewhere at least at this report level, although I have no idea which section. I also think the second of these should be included in the section where the script checks for "IP address in HELO", but it doesn't seem to be picked up. Unfortunately my PERL skills aren't sufficient to suggest amendments. I'm attaching todays 'Unmatched entries in their entirety below in case that helps. Jim **Unmatched Entries** 2017-02-23 15:30:15 H=(1.2.3.4) [200.113.197.5] rejected MAIL <[email protected]>: Access denied - Invalid HELO name (See RFC2821 4.1.3): 1 Time(s) 2017-02-23 15:41:20 H=(1.2.3.4) [124.239.177.85] rejected MAIL <[email protected]>: Access denied - Invalid HELO name (See RFC2821 4.1.3): 1 Time(s) 2017-02-23 15:41:28 H=(1.2.3.4) [183.129.206.100] rejected MAIL <[email protected]>: Access denied - Invalid HELO name (See RFC2821 4.1.3): 1 Time(s) 2017-02-23 15:42:58 H=(1.2.3.4) [41.164.64.138] rejected MAIL <[email protected]>: Access denied - Invalid HELO name (See RFC2821 4.1.3): 1 Time(s) 2017-02-23 16:23:00 TLS error on connection from [118.193.22.195] (recv): Error in the pull function.: 1 Time(s) 2017-02-23 16:23:00 TLS error on connection from [118.193.22.195] (send): The specified session has been invalidated for some reason.: 1 Time(s) 2017-02-23 16:37:58 H=(1.2.3.4) [183.129.206.100] rejected MAIL <[email protected]>: Access denied - Invalid HELO name (See RFC2821 4.1.3): 1 Time(s) 2017-02-23 16:42:49 H=(1.2.3.4) [83.169.208.218] rejected MAIL <neuqsrwttfwtei-gQA0f/[email protected]>: Access denied - Invalid HELO name (See RFC2821 4.1.3): 1 Time(s) 2017-02-23 16:45:38 H=(1.2.3.4) [203.142.48.188] rejected MAIL <lqahqookjfy-oX+xmiVUYmApm30o7P5wbgC/[email protected]>: Access denied - Invalid HELO name (See RFC2821 4.1.3): 1 Time(s) 2017-02-23 16:52:43 dovecot_login authenticator failed for (USER) [93.174.95.34]: 535 Incorrect authentication data (set_id=austin-9IKiO1iGCm/[email protected]): 1 Time(s) 2017-02-23 17:00:36 H=(1.2.3.4) [178.174.199.124] rejected MAIL <[email protected]>: Access denied - Invalid HELO name (See RFC2821 4.1.3): 1 Time(s) 2017-02-23 17:01:24 H=(1.2.3.4) [93.170.122.30] rejected MAIL <[email protected]>: Access denied - Invalid HELO name (See RFC2821 4.1.3): 1 Time(s) 2017-02-23 17:06:28 H=(1.2.3.4) [221.214.208.226] rejected MAIL <svwmazkwkai-QygIW/[email protected]>: Access denied - Invalid HELO name (See RFC2821 4.1.3): 1 Time(s) 2017-02-23 17:10:17 H=(1.2.3.4) [176.115.139.214] rejected MAIL <[email protected]>: Access denied - Invalid HELO name (See RFC2821 4.1.3): 1 Time(s) 2017-02-23 17:45:57 H=(1.2.3.4) [84.17.27.245] rejected MAIL <[email protected]>: Access denied - Invalid HELO name (See RFC2821 4.1.3): 1 Time(s) 2017-02-23 17:53:43 H=(1.2.3.4) [45.113.64.227] rejected MAIL <cvqnthifu-JSeBA2P0CN/[email protected]>: Access denied - Invalid HELO name (See RFC2821 4.1.3): 1 Time(s) 2017-02-23 18:16:46 H=(1.2.3.4) [222.52.76.50] rejected MAIL <hzjpjikeqi-vQRyQ5s0QhtWk0Htik3J/[email protected]>: Access denied - Invalid HELO name (See RFC2821 4.1.3): 1 Time(s) 2017-02-23 18:17:55 dovecot_login authenticator failed for (USER) [113.6.208.170]: 535 Incorrect authentication data (set_id=brandon-9IKiO1iGCm/[email protected]): 1 Time(s) 2017-02-23 18:39:29 dovecot_login authenticator failed for (USER) [94.102.60.172]: 535 Incorrect authentication data (set_id=gary-9IKiO1iGCm/[email protected]): 1 Time(s) 2017-02-23 18:39:37 dovecot_login authenticator failed for (USER) [89.248.171.234]: 535 Incorrect authentication data (set_id=kyle-9IKiO1iGCm/[email protected]): 1 Time(s) 2017-02-23 18:48:47 H=(1.2.3.4) [68.170.110.27] rejected MAIL <[email protected]>: Access denied - Invalid HELO name (See RFC2821 4.1.3): 1 Time(s) 2017-02-23 19:12:26 dovecot_login authenticator failed for (USER) [93.174.95.34]: 535 Incorrect authentication data ([email protected]): 1 Time(s) 2017-02-23 20:10:12 dovecot_login authenticator failed for (USER) [94.102.60.82]: 535 Incorrect authentication data (set_id=test-9IKiO1iGCm/[email protected]): 1 Time(s) 2017-02-23 20:32:44 H=(1.2.3.4) [37.32.45.1] rejected MAIL <[email protected]>: Access denied - Invalid HELO name (See RFC2821 4.1.3): 1 Time(s) 2017-02-23 20:36:28 H=(1.2.3.4) [120.234.15.130] rejected MAIL <[email protected]>: Access denied - Invalid HELO name (See RFC2821 4.1.3): 1 Time(s) 2017-02-23 20:39:06 dovecot_plain authenticator failed for web189c25.carrierzone.com [64.29.146.189]: 535 Incorrect authentication data (set_id=rh): 1 Time(s) 2017-02-23 20:39:07 TLS error on connection from web189c25.carrierzone.com [64.29.146.189] (recv): The TLS connection was non-properly terminated.: 1 Time(s) 2017-02-23 20:39:07 TLS error on connection from web189c25.carrierzone.com [64.29.146.189] (send): The specified session has been invalidated for some reason.: 1 Time(s) 2017-02-23 20:39:21 TLS error on connection from web189c25.carrierzone.com [64.29.146.189] (recv): The TLS connection was non-properly terminated.: 1 Time(s) 2017-02-23 20:39:21 TLS error on connection from web189c25.carrierzone.com [64.29.146.189] (send): The specified session has been invalidated for some reason.: 1 Time(s) 2017-02-23 20:39:21 dovecot_plain authenticator failed for web189c25.carrierzone.com [64.29.146.189]: 535 Incorrect authentication data (set_id=rh@%domain@): 1 Time(s) 2017-02-23 20:42:43 TLS error on connection from ec2-54-212-220-178.us-west-2.compute.amazonaws.com [54.212.220.178] (gnutls_handshake): The TLS connection was non-properly terminated.: 1 Time(s) 2017-02-23 20:50:29 H=(1.2.3.4) [62.122.203.82] rejected MAIL <tgscsiuhuoas-J/[email protected]>: Access denied - Invalid HELO name (See RFC2821 4.1.3): 1 Time(s) 2017-02-23 20:59:40 dovecot_login authenticator failed for (USER) [94.102.60.172]: 535 Incorrect authentication data ([email protected]): 1 Time(s) 2017-02-23 20:59:52 dovecot_login authenticator failed for (USER) [89.248.171.234]: 535 Incorrect authentication data ([email protected]): 1 Time(s) 2017-02-23 21:16:00 H=(1.2.3.4) [27.203.224.200] rejected MAIL <[email protected]>: Access denied - Invalid HELO name (See RFC2821 4.1.3): 1 Time(s) 2017-02-23 21:28:48 TLS error on connection from ec2-52-53-166-168.us-west-1.compute.amazonaws.com [52.53.166.168] (gnutls_handshake): The TLS connection was non-properly terminated.: 1 Time(s) 2017-02-23 21:31:47 dovecot_login authenticator failed for (User) [80.82.65.150]: 535 Incorrect authentication data (set_id=admin-9IKiO1iGCm/[email protected]): 1 Time(s) 2017-02-23 21:48:05 H=(1.2.3.4) [58.216.156.126] rejected MAIL <[email protected]>: Access denied - Invalid HELO name (See RFC2821 4.1.3): 1 Time(s) 2017-02-23 22:02:40 dovecot_login authenticator failed for (User) [80.82.65.150]: 535 Incorrect authentication data (set_id=scanner-9IKiO1iGCm/[email protected]): 1 Time(s) 2017-02-23 22:20:33 H=(1.2.3.4) [120.234.15.130] rejected MAIL <[email protected]>: Access denied - Invalid HELO name (See RFC2821 4.1.3): 1 Time(s) 2017-02-23 22:33:43 dovecot_login authenticator failed for (User) [80.82.65.150]: 535 Incorrect authentication data (set_id=postmaster-9IKiO1iGCm/[email protected]): 1 Time(s) 2017-02-23 22:38:21 H=(1.2.3.4) [101.203.174.209] rejected MAIL <[email protected]>: Access denied - Invalid HELO name (See RFC2821 4.1.3): 1 Time(s) 2017-02-23 22:43:44 dovecot_login authenticator failed for (USER) [93.174.91.56]: 535 Incorrect authentication data ([email protected]): 1 Time(s) 2017-02-23 23:01:35 H=(1.2.3.4) [180.173.162.208] rejected MAIL <jqiazuyvgbk-yc0Hg/ngY142krK2H3IM2QC/[email protected]>: Access denied - Invalid HELO name (See RFC2821 4.1.3): 1 Time(s) 2017-02-23 23:04:46 dovecot_login authenticator failed for (User) [80.82.65.150]: 535 Incorrect authentication data (set_id=webmaster-9IKiO1iGCm/[email protected]): 1 Time(s) 2017-02-23 23:35:52 dovecot_login authenticator failed for (User) [80.82.65.150]: 535 Incorrect authentication data (set_id=support-9IKiO1iGCm/[email protected]): 1 Time(s) 2017-02-24 00:01:42 H=(1.2.3.4) [139.196.200.89] rejected MAIL <[email protected]>: Access denied - Invalid HELO name (See RFC2821 4.1.3): 1 Time(s) 2017-02-24 00:11:38 H=(1.2.3.4) [112.124.57.223] rejected MAIL <[email protected]>: Access denied - Invalid HELO name (See RFC2821 4.1.3): 1 Time(s) 2017-02-24 00:41:50 H=(1.2.3.4) [112.124.57.223] rejected MAIL <[email protected]>: Access denied - Invalid HELO name (See RFC2821 4.1.3): 1 Time(s) 2017-02-24 00:42:38 H=(1.2.3.4) [24.49.161.165] rejected MAIL <[email protected]>: Access denied - Invalid HELO name (See RFC2821 4.1.3): 1 Time(s) 2017-02-24 01:06:21 H=(1.2.3.4) [139.196.200.89] rejected MAIL <[email protected]>: Access denied - Invalid HELO name (See RFC2821 4.1.3): 1 Time(s) 2017-02-24 01:10:25 H=(1.2.3.4) [116.116.108.101] rejected MAIL <[email protected]>: Access denied - Invalid HELO name (See RFC2821 4.1.3): 1 Time(s) 2017-02-24 01:20:45 H=(1.2.3.4) [162.247.54.120] rejected MAIL <xrggobuclvdfaq-e9eDy/ZN0H5Wk0Htik3J/[email protected]>: Access denied - Invalid HELO name (See RFC2821 4.1.3): 1 Time(s) 2017-02-24 01:44:44 H=(1.2.3.4) [185.9.152.22] rejected MAIL <[email protected]>: Access denied - Invalid HELO name (See RFC2821 4.1.3): 1 Time(s) 2017-02-24 02:12:58 H=(1.2.3.4) [180.173.153.98] rejected MAIL <ssimoxtuw-6sV+Iu/[email protected]>: Access denied - Invalid HELO name (See RFC2821 4.1.3): 1 Time(s) 2017-02-24 02:49:44 H=(1.2.3.4) [58.59.68.91] rejected MAIL <[email protected]>: Access denied - Invalid HELO name (See RFC2821 4.1.3): 1 Time(s) 2017-02-24 02:54:07 H=(1.2.3.4) [218.58.52.158] rejected MAIL <[email protected]>: Access denied - Invalid HELO name (See RFC2821 4.1.3): 1 Time(s) 2017-02-24 02:56:59 dovecot_login authenticator failed for (USER) [93.174.95.34]: 535 Incorrect authentication data (set_id=willie-9IKiO1iGCm/[email protected]): 1 Time(s) 2017-02-24 03:08:05 dovecot_login authenticator failed for (USER) [113.6.208.170]: 535 Incorrect authentication data ([email protected]): 1 Time(s) 2017-02-24 03:18:57 H=(1.2.3.4) [116.116.108.101] rejected MAIL <[email protected]>: Access denied - Invalid HELO name (See RFC2821 4.1.3): 1 Time(s) 2017-02-24 03:35:10 dovecot_login authenticator failed for (User) [195.22.126.189]: 535 Incorrect authentication data (set_id=administrator): 1 Time(s) 2017-02-24 03:39:01 H=(1.2.3.4) [95.215.97.197] rejected MAIL <[email protected]>: Access denied - Invalid HELO name (See RFC2821 4.1.3): 1 Time(s) 2017-02-24 03:45:07 H=(1.2.3.4) [202.80.222.122] rejected MAIL <[email protected]>: Access denied - Invalid HELO name (See RFC2821 4.1.3): 1 Time(s) 2017-02-24 04:45:18 dovecot_login authenticator failed for (USER) [94.102.58.20]: 535 Incorrect authentication data (set_id=kyle-9IKiO1iGCm/[email protected]): 1 Time(s) 2017-02-24 04:45:27 dovecot_login authenticator failed for (USER) [89.248.171.234]: 535 Incorrect authentication data (set_id=carl-9IKiO1iGCm/[email protected]): 1 Time(s) 2017-02-24 04:45:29 dovecot_login authenticator failed for (USER) [94.102.60.172]: 535 Incorrect authentication data (set_id=gary-9IKiO1iGCm/[email protected]): 1 Time(s) 2017-02-24 05:13:34 H=(1.2.3.4) [80.90.89.138] rejected MAIL <dpjnbuucestdu-C9k+zcEsEyYzU19Op4a7xvU/[email protected]>: Access denied - Invalid HELO name (See RFC2821 4.1.3): 1 Time(s) 2017-02-24 06:17:29 dovecot_login authenticator failed for (USER) [93.174.91.56]: 535 Incorrect authentication data (set_id=austin-9IKiO1iGCm/[email protected]): 1 Time(s) 2017-02-24 06:29:05 H=(1.2.3.4) [62.122.203.82] rejected MAIL <[email protected]>: Access denied - Invalid HELO name (See RFC2821 4.1.3): 1 Time(s) 2017-02-24 06:35:56 H=(1.2.3.4) [47.89.47.13] rejected MAIL <qwrvq-o0scyUSH7fMh/[email protected]>: Access denied - Invalid HELO name (See RFC2821 4.1.3): 1 Time(s) 2017-02-24 07:05:00 dovecot_login authenticator failed for (USER) [94.102.58.20]: 535 Incorrect authentication data ([email protected]): 1 Time(s) 2017-02-24 07:05:16 dovecot_login authenticator failed for (USER) [94.102.60.172]: 535 Incorrect authentication data ([email protected]): 1 Time(s) 2017-02-24 07:05:18 dovecot_login authenticator failed for (USER) [89.248.171.234]: 535 Incorrect authentication data ([email protected]): 1 Time(s) 2017-02-24 07:09:02 H=(1.2.3.4) [185.9.152.22] rejected MAIL <yripwbhiphwj-ZpHVe736Hb/[email protected]>: Access denied - Invalid HELO name (See RFC2821 4.1.3): 1 Time(s) ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, SlashDot.org! http://sdm.link/slashdot