gmane.comp.log.logwatch.devel

SF.net SVN: logwatch:[107] scripts/services/puppet

2012-05-17T15:41:03

Revision: 107
          http://logwatch.svn.sourceforge.net/logwatch/?rev=107&view=rev
Author:   opoplawski
Date:     2012-05-17 15:41:03 +0000 (Thu, 17 May 2012)
Log Message:
-----------
Handle more puppet messages

Modified Paths:
--------------
    scripts/services/puppet

Modified: scripts/services/puppet
===================================================================
--- scripts/services/puppet2012-05-12 14:24:07 UTC (rev 106)
+++ scripts/services/puppet2012-05-17 15:41:03 UTC (rev 107)
< at >< at > -74,6 +74,8 < at >< at >
       $ChangedFilesContent{$File} .= $Content;
    } elsif ($ThisLine =~ /File\[(.+)\].+created/) {
       $CreatedFiles{$1}++;
+   } elsif ($ThisLine =~ /File\[(.+)\].+defined content/) {
+      $CreatedFiles{$1}++;
    } elsif ($ThisLine =~ /File\[(.+)\].+removed/) {
       $RemovedFiles{$1}++;
    } elsif (($fileinfo) = ($ThisLine =~ /Filebucketed (.*)/)) {
< at >< at > -99,6 +101,10 < at >< at >
       $ServiceStarts{$1}++;
    } elsif ($ThisLine =~ /Service\[(.+)\].+Triggering 'refresh' from [0-9]+ dependencies

SF.net SVN: logwatch:[106] scripts/services/vsftpd

2012-05-12T14:24:08

Revision: 106
          http://logwatch.svn.sourceforge.net/logwatch/?rev=106&view=rev
Author:   mtremaine
Date:     2012-05-12 14:24:07 +0000 (Sat, 12 May 2012)
Log Message:
-----------
RHEL/Centos 6 puts the PID in the service name, fixed all regex to handle both styles -mgt

Modified Paths:
--------------
    scripts/services/vsftpd

Modified: scripts/services/vsftpd
===================================================================
--- scripts/services/vsftpd2012-05-09 07:53:09 UTC (rev 105)
+++ scripts/services/vsftpd2012-05-12 14:24:07 UTC (rev 106)
< at >< at > -34,50 +34,51 < at >< at >
         ( $ThisLine =~ /authentication failure/ )
       )
    { # We don't care about these
+
    } elsif ( ($IP,$Email) = ( $ThisLine =~ /OK LOGIN: Client \"(.*)\", anon password \"(.*)\"$/ ) ) {
       $Temp = "    (" . $IP . "): " . $Email . " - ";
       $AnonLogins{$Temp}++;
-   } elsif ( ($PID, $User,$IP) = ( $ThisLine =~ /\[(.*)\] \[(.*)\] OK LOGIN: Client \"(.*)\"$/ ) ) {
+   } elsif ( ($User,$IP) = ( $ThisLine =~ /(?:\[.*\]

SF.net SVN: logwatch:[105] scripts/services/dhcpd

2012-05-09T07:53:10

Revision: 105
          http://logwatch.svn.sourceforge.net/logwatch/?rev=105&view=rev
Author:   stefjakobs
Date:     2012-05-09 07:53:09 +0000 (Wed, 09 May 2012)
Log Message:
-----------
fix: DHCPDECLINE
fix: duplicate leases

Modified Paths:
--------------
    scripts/services/dhcpd

Modified: scripts/services/dhcpd
===================================================================
--- scripts/services/dhcpd2012-05-08 19:29:18 UTC (rev 104)
+++ scripts/services/dhcpd2012-05-09 07:53:09 UTC (rev 105)
< at >< at > -133,7 +133,7 < at >< at >
       if ($Detail >= 5) {
          $data{'Warnings'}{$line}++;
       }
-   } elsif ($line =~ s/^DHCPDECLINE of ([\d\.]+) from ([\w:]+) \(([^)]+)\) via ([\d\.]+).*$/$1 -> $2 [$3] ($4)/) {
+   } elsif ($line =~ s/^DHCPDECLINE of ([\d\.]+) from ([\w:]+) (?:\(([^)]+)\) )?via ([\d\.]+).*$/$1 -> $2 [$3] ($4)/) {
       if ($Detail >= 5) {
          $data{'Addresses Declined'}{$line}++;
       }
< at >< at > -193,7 +193,7 < at >< at >
       if ($Detail >= 3) {
          $data{'Duplicate lease'}{$line}++;

SF.net SVN: logwatch:[104]scripts/services/pam_unix

2012-05-08T19:29:18

Revision: 104
          http://logwatch.svn.sourceforge.net/logwatch/?rev=104&view=rev
Author:   mtremaine
Date:     2012-05-08 19:29:18 +0000 (Tue, 08 May 2012)
Log Message:
-----------
Added ruser detection for dovecot to silence that under RHEL/Centos 6 -mgt

Modified Paths:
--------------
    scripts/services/pam_unix

Modified: scripts/services/pam_unix
===================================================================
--- scripts/services/pam_unix2012-05-02 15:46:51 UTC (rev 103)
+++ scripts/services/pam_unix2012-05-08 19:29:18 UTC (rev 104)
< at >< at > -232,6 +232,8 < at >< at >
          ($Detail >= 5) && $data{$service}{'Sessions Opened'}{$line}++;
       } elsif ($line =~ s/^authentication failure;.* user=(.+)$/$1/) {
          $data{$service}{'Authentication Failures'}{$line}++;
+      } elsif ($line =~ s/^authentication failure;.* ruser=(.+) rhost=.+$/$1/) {
+         $data{$service}{'Authentication Failures'}{$line}++;
       } elsif ($line =~ /check pass; user unknown/) {
          $data{$service}{'Invalid Use

SF.net SVN: logwatch:[103] scripts/services/puppet

2012-05-02T15:46:51

Revision: 103
          http://logwatch.svn.sourceforge.net/logwatch/?rev=103&view=rev
Author:   opoplawski
Date:     2012-05-02 15:46:51 +0000 (Wed, 02 May 2012)
Log Message:
-----------
Handle puppet content diff entries

Modified Paths:
--------------
    scripts/services/puppet

Modified: scripts/services/puppet
===================================================================
--- scripts/services/puppet2012-04-25 17:08:39 UTC (rev 102)
+++ scripts/services/puppet2012-05-02 15:46:51 UTC (rev 103)
< at >< at > -68,6 +68,10 < at >< at >
       $ChangedFiles{$1}++;
    } elsif ($ThisLine =~ /File\[(.+)\].+content changed/) {
       $ChangedFiles{$1}++;
+   } elsif (($File, $Content) = $ThisLine =~ /\(\/File\[(.+)\]\/content\) #012(.*)/) {
+      $Content =~ s/#011/\t/g;
+      $Content =~ s/#012/\n        /g;
+      $ChangedFilesContent{$File} .= $Content;
    } elsif ($ThisLine =~ /File\[(.+)\].+created/) {
       $CreatedFiles{$1}++;
    } elsif ($ThisLine =~ /File\[(.+)\].+removed/) {
< at >< at > -131,6 +135,9 < at >< at >
    print "\nCh

Fwd: Bug#670877: logwatch: the parameter --logdiris partially ignored

Willi Mann — 2012-04-30T06:07:32

Hi!

I got attached bug report via the Debian bug tracking system. IMHO,
logwatch should really change behaviour here, particularly as the change
would be quite easy,

WM

-------- Original Message --------
Subject: Bug#670877: logwatch: the parameter --logdir is partially ignored
Resent-Date: Sun, 29 Apr 2012 21:33:02 +0000
Resent-From: Maarten Derickx <m.derickx.student-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org>
Resent-To: debian-bugs-dist-0aAXYlwwYIJuHlm7Suoebg< at >public.gmane.org
Resent-CC: Willi Mann <willi-pz1JH+IlyL4< at >public.gmane.org>
Date: Sun, 29 Apr 2012 23:25:03 +0200
From: Maarten Derickx <m.derickx.student-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org>
Reply-To: Maarten Derickx <m.derickx.student-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org>,
670877-61a8vm9lEZVf4u+23C9RwQ< at >public.gmane.org
To: Debian Bug Tracking System <submit-61a8vm9lEZVf4u+23C9RwQ< at >public.gmane.org>

Package: logwatch
Version: 7.3.6.cvs20090906-1squeeze1
Severity: minor

I copied some logfiles to /tmp because I only wanted to know what was in

Re: 9 Debian patches for inclusion

Willi Mann — 2012-04-29T15:06:17


Hi!

Yes, that's the bug report. The problem is that logwatch only expects 
logfiles to be compressed if they were declared via Archive, not via 
Logfile. My hack moves compressed logfiles to archives, which works as 
$Config{archives} is on by default. The proper way to handle this would 
probably be to first collect all filenames (as specified Logfiles plus 
Archives if selected), sort them, apply unique filter and then decide 
whether decompressing is required, but such a change would require bigger 
changes. 
 
WM


------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/

Sshd - incorrect behavior (patch included)

Jan Synacek — 2012-04-27T12:21:34

Hello all,

currently, the sshd service script is not behaving correctly. Consider the
following input:
  Jan 18 18:22:04 raptor sshd[8045]: Invalid user cisco from 10.132.4.251
  Jan 19 00:22:04 raptor sshd[8046]: input_userauth_request: invalid user cisco

The script as it is now reports:
  Illegal users from:
      undef: 1 times
      10.132.4.251: 1 times
as it reports the same user but two different messages.

Attached is a patch resolving this problem.

Re: dovecot proxy messages

Orion Poplawski — 2012-04-25T17:11:31

Okay, I checked in my changes.  This results in (edited):

  --------------------- Dovecot Begin ------------------------

  Dovecot disconnects:
     Inactivity (no auth attempts): 1 Time(s)
     no auth attempts: 2 Time(s)

  Logout/aborts:
     auth failed, 1 attempts: 1 Time(s)

  Dovecot Proxy IMAP and POP3 Successful Logins:
    User blah:   (28 IMAP)
      From 184.96.3.50: 7 Time(s)
      From 97.124.147.59: 21 Time(s)
    Total: 28 Time(s)

    User blahpop:   (43 POP3)
      From 76.25.252.182: 43 Time(s)

  Total: 1049 successful logins

  Dovecot Proxy disconnects:
     by client: 257 Time(s)
     by client: Connection reset by peer: 1 Time(s)
     by server: 791 Time(s)

  ---------------------- Dovecot End -------------------------

SF.net SVN: logwatch:[102]scripts/services/sendmail

2012-04-25T17:08:40

Revision: 102
          http://logwatch.svn.sourceforge.net/logwatch/?rev=102&view=rev
Author:   opoplawski
Date:     2012-04-25 17:08:39 +0000 (Wed, 25 Apr 2012)
Log Message:
-----------
Let more Milter: data, reject=55? messages be ignored and processed with the to=,stat= line (spamass-milter)

Modified Paths:
--------------
    scripts/services/sendmail

Modified: scripts/services/sendmail
===================================================================
--- scripts/services/sendmail2012-04-25 16:57:46 UTC (rev 101)
+++ scripts/services/sendmail2012-04-25 17:08:39 UTC (rev 102)
< at >< at > -434,7 +434,7 < at >< at >
 
       # the following two return errors that are caught in the "to=" statements
       # file=srvrsmtp.c, LogLevel>3, LOG_INFO
-      ( $ThisLine =~ /^Milter: data, reject=554 5\.7\.1 (.*)/ ) or
+      ( $ThisLine =~ /^Milter: data, reject=55[0-9] 5\.7\.1 (.*)/ ) or
       # file=srvrsmtp.c, LogLevel>3, LOG_INFO
       ( $ThisLine =~ /^Milter: data, discard$/ ) or
       # file=srvrsmtp.c, LogLevel>9, LOG

SF.net SVN: logwatch:[101] scripts/services/dovecot

2012-04-25T16:57:46

Revision: 101
          http://logwatch.svn.sourceforge.net/logwatch/?rev=101&view=rev
Author:   opoplawski
Date:     2012-04-25 16:57:46 +0000 (Wed, 25 Apr 2012)
Log Message:
-----------
Handle dovecot proxy messages

Modified Paths:
--------------
    scripts/services/dovecot

Modified: scripts/services/dovecot
===================================================================
--- scripts/services/dovecot2012-04-17 15:32:55 UTC (rev 100)
+++ scripts/services/dovecot2012-04-25 16:57:46 UTC (rev 101)
< at >< at > -198,6 +198,24 < at >< at >
          $Connection{$Host}++;
        }
 
+   # Dovecot 2.0 proxy
+   } elsif ( ($User, $Host) = ( $ThisLine =~ /^$dovecottag pop3-login: proxy\((.*)\): started proxying to .*: user=<.*>, method=.*, rip=(.*), lip=/ ) ) {
+      if ($Host !~ /$IgnoreHost/) {
+         $ProxyLogin{$User}{$Host}++;
+         $ProxyLoginPOP3{$User}++;
+         $ProxyConnectionPOP3{$Host}++;
+         $ProxyConnection{$Host}++;
+      }
+   } elsif ( ($User, $Host) = ( $ThisLine =~ /^$dovecottag imap-login:

Re: dovecot proxy messages

Mike Tremaine — 2012-04-24T22:27:57

That makes sense to me. I don;t have any dovecot proxy's (yet) but if I was looking at the report I would want those broken out as Proxy Logins and Proxy Disconnects and whatever other details.

-Mike
On Apr 24, 2012, at 3:15 PM, Orion Poplawski wrote:



------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/

dovecot proxy messages

Orion Poplawski — 2012-04-24T22:15:04

I just setup a dovecot proxy and am seeing lots of unmatched messages.  Some 
examples:

     dovecot: imap-login: proxy(alexand): disconnecting 97.124.147.59 
(Disconnected by client): 7 Time(s)
     dovecot: imap-login: proxy(alexand): disconnecting 97.124.147.59 
(Disconnected by server): 5 Time(s)
     dovecot: imap-login: proxy(alexand): started proxying to 
mail.cora.nwra.com:993: user=<alexand>, method=PLAIN, rip=97.124.147.59, 
lip=4.28.99.182, TLS: 12 Time(s)

     dovecot: pop3-login: proxy(werne): disconnecting 166.147.82.151 
(Disconnected by client): 1 Time(s)
     dovecot: pop3-login: proxy(werne): disconnecting 166.147.82.151 
(Disconnected by server): 2 Time(s)
     dovecot: pop3-login: proxy(werne): disconnecting 206.124.7.172 
(Disconnected by server): 200 Time(s)
     dovecot: pop3-login: proxy(werne): disconnecting 207.173.60.178 
(Disconnected by client: Connection reset by peer): 1 Time(s)
     dovecot: pop3-login: proxy(werne): disconnecting 207.173.60.178 
(Disconnected by server): 1

SF.net SVN: logwatch:[100]

2012-04-17T15:32:55

Revision: 100
          http://logwatch.svn.sourceforge.net/logwatch/?rev=100&view=rev
Author:   stefjakobs
Date:     2012-04-17 15:32:55 +0000 (Tue, 17 Apr 2012)
Log Message:
-----------
added postgresql support from Gilles Darold.

Added Paths:
-----------
    conf/logfiles/postgresql.conf
    conf/services/postgresql.conf
    scripts/services/postgresql

Added: conf/logfiles/postgresql.conf
===================================================================
--- conf/logfiles/postgresql.conf                        (rev 0)
+++ conf/logfiles/postgresql.conf2012-04-17 15:32:55 UTC (rev 100)
< at >< at > -0,0 +1,21 < at >< at >
+# Logfile definition for PostgreSQL
+
+# What actual file?  Defaults to LogPath if not absolute path....
+LogFile = postgresql/postgresql.log
+LogFile = postgresql/postgresql.log.1
+LogFile = postgresql/postgresql-*.log
+LogFile = postgresql/postgresql-*.log.1
+
+# If the archives are searched, here is one or more line
+# (optionally containing wildcards) that tell where they are...
+#If you use a "-" i

SF.net SVN: logwatch:[99] scripts/services/dhcpd

2012-04-16T15:35:33

Revision: 99
          http://logwatch.svn.sourceforge.net/logwatch/?rev=99&view=rev
Author:   stefjakobs
Date:     2012-04-16 15:35:32 +0000 (Mon, 16 Apr 2012)
Log Message:
-----------
dhcpd: report if client has duplicate leases

Modified Paths:
--------------
    scripts/services/dhcpd

Modified: scripts/services/dhcpd
===================================================================
--- scripts/services/dhcpd2012-04-16 15:18:54 UTC (rev 98)
+++ scripts/services/dhcpd2012-04-16 15:35:32 UTC (rev 99)
< at >< at > -193,6 +193,10 < at >< at >
       if ($Detail >= 3) {
          $data{'Duplicate lease'}{$line}++;
       }
+   } elsif ($line =~ /^client [a-f0-9:]{18} has duplicate leases on/) {
+      if ($Detail >= 3) {
+         $data{'Duplicate lease'}{$line}++;
+      }
    } elsif ($line =~ /^DHCPDISCOVER from .* via \S+: (.*): no free leases/) {
       $data{'No Free Leases'}{$1}++;
    } elsif ($line =~ /^DHCPDISCOVER from .* via (\S+): unknown network segment/) {

This was sent by the SourceForge.net collaborative de

Re: stunnel filter

Stefan Jakobs — 2012-04-16T15:20:23

Jonas Marczona wrote:

Hello Jonas,

I reworked your patch and checked it in as revision 98. Please check if it 
still works as intended.

Thanks
Stefan


------------------------------------------------------------------------------
For Developers, A Lot Can Happen In A Second.
Boundary is the first to Know...and Tell You.
Monitor Your Applications in Ultra-Fine Resolution. Try it FREE!
http://p.sf.net/sfu/Boundary-d2dvs2

SF.net SVN: logwatch:[98]

2012-04-16T15:18:54

Revision: 98
          http://logwatch.svn.sourceforge.net/logwatch/?rev=98&view=rev
Author:   stefjakobs
Date:     2012-04-16 15:18:54 +0000 (Mon, 16 Apr 2012)
Log Message:
-----------
stunnel format mismatch and allowed_services patch from Jonas Marczona

Modified Paths:
--------------
    conf/services/stunnel.conf
    scripts/services/stunnel

Modified: conf/services/stunnel.conf
===================================================================
--- conf/services/stunnel.conf2012-04-16 14:11:25 UTC (rev 97)
+++ conf/services/stunnel.conf2012-04-16 15:18:54 UTC (rev 98)
< at >< at > -17,6 +17,11 < at >< at >
 # Which logfile group...
 LogFile = secure
 
+# Reduce output for allowed services
+# all services listed comma separated in the following variable will be
+# summarized to "how often was this service used"
+$STUNNEL_ALLOWED_SERVICES = ""
+
 *OnlyService = stunnel
 *RemoveHeaders
 

Modified: scripts/services/stunnel
===================================================================
--- scripts/services/stunnel2012

Re: freeradius

Stefan Jakobs — 2012-04-16T14:12:46

Jonas Marczona wrote:

Hi Jonas,


I reworked your filter and checked it into the subversion repository (Revision 
97). Can you please check if it works as intended? 

If not: Please send me a freeradius sample logfile.

Hint: The *ApplyStdDate will probably only work with syslog logging.

[ ... ]

Regards
Stefan

------------------------------------------------------------------------------
For Developers, A Lot Can Happen In A Second.
Boundary is the first to Know...and Tell You.
Monitor Your Applications in Ultra-Fine Resolution. Try it FREE!
http://p.sf.net/sfu/Boundary-d2dvs2

SF.net SVN: logwatch:[97] scripts/shared

2012-04-16T14:11:25

Revision: 97
          http://logwatch.svn.sourceforge.net/logwatch/?rev=97&view=rev
Author:   stefjakobs
Date:     2012-04-16 14:11:25 +0000 (Mon, 16 Apr 2012)
Log Message:
-----------
freeradius service script from Jonas Marczona added.
shared script removeheaders modified to remove freeradius style dates

Modified Paths:
--------------
    scripts/shared/removeheaders

Added Paths:
-----------
    conf/logfiles/freeradius.conf
    conf/services/freeradius.conf
    scripts/services/freeradius

Added: conf/logfiles/freeradius.conf
===================================================================
--- conf/logfiles/freeradius.conf                        (rev 0)
+++ conf/logfiles/freeradius.conf2012-04-16 14:11:25 UTC (rev 97)
< at >< at > -0,0 +1,22 < at >< at >
+##########################################################################
+# freeradius
+#Marczona
+#28.12.2011
+##########################################################################
+
+
+# What actual file?  Defaults to LogPath if not absolute path....
+L

Re: 9 Debian patches for inclusion

Stefan Jakobs — 2012-04-16T09:56:13

Mike Tremaine wrote:

Debian and Ubuntu create the following logfiles with samba 3.4:
/var/log/samba/log.nmbd
/var/log/samba/log.smbd

And the following archives:
/var/log/sambs/log.nmbd.1.gz
/var/log/sambs/log.nmbd.2.gz
...
/var/log/samba/log.smbd.1.gz
/var/log/samba/log.smbd.2.gz
...

And /usr/share/logwatch/default.conf/logfiles/samba.conf 
(logwatch_7.3.6.cvs20090906-1ubuntu2.1_all.deb) has:
LogFile = samba-log.*
LogFile = samba/*


Stefan


------------------------------------------------------------------------------
For Developers, A Lot Can Happen In A Second.
Boundary is the first to Know...and Tell You.
Monitor Your Applications in Ultra-Fine Resolution. Try it FREE!
http://p.sf.net/sfu/Boundary-d2dvs2

SF.net SVN: logwatch:[94] scripts/services/http

2012-04-14T17:32:47

Revision: 94
          http://logwatch.svn.sourceforge.net/logwatch/?rev=94&view=rev
Author:   mtremaine
Date:     2012-04-14 17:32:47 +0000 (Sat, 14 Apr 2012)
Log Message:
-----------
%V %I an %O LogFormat options added from Jonathan Kamens -mgt

Modified Paths:
--------------
    scripts/services/http

Modified: scripts/services/http
===================================================================
--- scripts/services/http2012-04-14 17:27:52 UTC (rev 93)
+++ scripts/services/http2012-04-14 17:32:47 UTC (rev 94)
< at >< at > -402,6 +402,15 < at >< at >
       # issue
       $parse_field[$parse_index][$parse_subindex++] = "bytes_transfered";
       $parse_string[$parse_index] .= "(-|\\d*)";
+   } elsif ($logformat =~ /\G%V/gc) {
+      $parse_string[$parse_index] .= "(\\S*?)";
+      $parse_field[$parse_index][$parse_subindex++] = "server_name";
+   } elsif ($logformat =~ /\G%I/gc) {
+      $parse_field[$parse_index][$parse_subindex++] = "bytes_in";
+      $parse_string[$parse_index] .= "(-|\\d*)";
+   } elsif ($logformat