Commit 184d3533eb9aac7e64acfdc0e905dff181b702ed - logwatch

Imported Upstream version 7.4.0+svn20111221rev79 Willi Mann 12 years ago

8 changed file(s) with 135 addition(s) and 38 deletion(s). Raw diff Collapse all Expand all

-0

conf/services/kernel.conf less more

25	25	# against. Separate multiple executables with \|
26	26	# $ignore_faults = npviewer.bin
27	27
	28	# Ignore Error: state manager encountered RPCSEC_GSS session expired against NFSv4 server
	29	# messages which often occur when kerberos tickets expire
	30	# $ignore_rpcsec_expired = Yes
	31
28	32	########################################################
29	33	# This was written and is maintained by:
30	34	# Kirk Bauer <kirk@kaybee.org>

-0

conf/services/spamassassin.conf less more

7	7	*OnlyService = spamd
8	8	*RemoveHeaders
9	9
	10	# Ignore connections from these hosts.
	11	# The value is a regular expression that the hostname plus IP address is matched
	12	# against. Separate multiple hosts/IPs with \|
	13	# $ignore_connections = myspamclient.mydomain
	14
10	15	# vi: shiftwidth=3 tabstop=3 et

+15

-3

scripts/services/audit less more

94	94	my $UELimit = 10;
95	95	my $ThisLine;
96	96	my %Warning = ();
	97	my %AuditctlStatus = ();
97	98
98	99	print STDERR "\n\nDEBUG: Inside audit filter\n\n" if ( $Debug >= 5 );
99	100

113	114	( $ThisLine =~ /: enforcing=[0-9]+ old_enforcing=[0-9]+ auid=[0-9]+/) or
114	115	( $ThisLine =~ /: policy loaded auid=[0-9]+/) or
115	116	( $ThisLine =~ /: user pid=[0-9]+ uid=[0-9]+ auid=[0-9]+ subj=system_u:system_r:system_dbusd_t:[0-9a-z:.\-]+ msg=/) or
116		( $ThisLine =~ /audit$[0-9.]+:[0-9]+$: (selinux=[0-9]+\|auid=[0-9]+\|prom=[0-9]+\|old_prom=[0-9]+\|dev=[^ ]+\| )+$/) or
	117	( $ThisLine =~ /audit$[0-9.]+:[0-9]+$: (selinux=[0-9]+\|auid=[0-9]+\|prom=[0-9]+\|old_prom=[0-9]+\|dev=[^ ]+\|ses=[0-9]+\| )+$/) or
117	118	( $ThisLine =~ /auditd[ ]+S [0-9A-F]+ [0-9]+ [0-9]+[ ]+[0-9]([ ][0-9]+[ ]\|[ ]*)[0-9]+ [0-9]+ $NOTLB$/) or
118	119	( $ThisLine =~ /Started dispatcher: \/sbin\/audispd pid: [0-9]+/) or
119	120	( $ThisLine =~ /audit$[0-9.]:[0-9]$: bool=.* val=.* old_val=.* auid=[0-9]*/) or
120	121	( $ThisLine =~ /type=[0-9]+ audit$[0-9.]:[0-9]$: audit_enabled=[0-9]* old=[0-9]* auid=[0-9]* ses=[0-9]* subj=system_u:system_r:.:s0 res=[0-9]/) or
121	122	( $ThisLine =~ /type=[0-9]+ audit$[0-9.]:[0-9]$: auid=[0-9]* ses=[0-9]* subj=system_u:system_r:.:s0 op=. key=.* list=[0-9]* res=[0-9]*/) or
122	123	( $ThisLine =~ /type=[0-9]+ audit$[0-9.]:[0-9]$: cwd=".*"/) or
	124	( $ThisLine =~ /type=[0-9]+ audit$[0-9.]:[0-9]$: user/) or
123	125	( $ThisLine =~ /audit_printk_skb: [0-9]* callbacks suppressed/) or
124		( $ThisLine =~ /item=[0-9] name="\S" inode=[0-9]+ dev=\S mode=[0-9]* ouid=[0-9]* ogid=[0-9]* rdev=[0-9:]* obj=\S*/)
	126	( $ThisLine =~ /item=[0-9] name="\S" inode=[0-9]+ dev=\S mode=[0-9]* ouid=[0-9]* ogid=[0-9]* rdev=[0-9:]* obj=\S*/) or
	127	( $ThisLine =~ /^No rules$/ )
125	128	) {
126	129	# Ignore these entries
127	130	} elsif ( $ThisLine =~ /audit$[0-9]{10}.[0-9]{3}:[0-9]$: initialized$/) {

146	149	} elsif (( $ThisLine =~ /Audit daemon is low on disk space for logging/) or
147	150	( $ThisLine =~ /Audit daemon is suspending logging due to low disk space./)) {
148	151	$Warning{$ThisLine}++;
	152	} elsif ( my ($status) = ( $ThisLine =~ /AUDIT_STATUS: (.*)/ ) ) {
	153	$AuditctlStatus{$status}++;
149	154	} elsif ( $Detail > 9 ) {
150	155	if ( $ThisLine =~ /avc:\sdenied\s{\s([^}]+).scontext=(\S+)\stcontext=(\S+)\stclass=(\S+)/ ) {
151	156	$denials{$2.' '.$3.' ('.$1.$4 . ')'}++;

234	239	print " starts with pid change: $NumberOfDStartsPid \n"
235	240	}
236	241
237		if ($Detail and $NumberOfDStops) {
	242	if ($Detail and $NumberOfDStops) {
238	243	print "\n Number of audit daemon stops: $NumberOfDStops \n";
	244	}
	245
	246	if ($Detail and keys(%AuditctlStatus)) {
	247	print "\n Auditctl status:\n";
	248	foreach my $key (sort keys %AuditctlStatus) {
	249	print " $key: ". $AuditctlStatus{$key} . " times\n";
	250	}
239	251	}
240	252
241	253	if ($NumberOfLostMessages) {

+26

-0

scripts/services/evtsystem less more

59	59	next if $ExpandedString =~ /Microsoft $R$ Windows $R$ \d+\.\d+\. \d+ Service Pack \d/;
60	60	next if $ExpandedString =~ /The Event log service was started./;
61	61	next if $ExpandedString =~ /The Event log service was stopped./;
	62	next if $ExpandedString =~ /The system uptime is \d+ seconds/;
	63	}
	64
	65	if ($System =~ /Microsoft-Windows-Kernel-Power/) {
	66	#High Detail
	67	next if $ExpandedString =~ /The system is entering sleep/ and $Detail < 10;
	68	}
	69
	70	if ($System =~ /Microsoft-Windows-Power-Troubleshooter/) {
	71	#High Detail
	72	next if $ExpandedString =~ /The system has resumed from sleep/ and $Detail < 10;
	73	}
	74
	75	if ($System =~ /Microsoft-Windows-Time-Service/) {
	76	#High Detail
	77	next if $ExpandedString =~ /The time provider NtpClient is currently receiving valid time data from/ and $Detail < 10;
	78	}
	79
	80	if ($System =~ /Microsoft-Windows-Winlogon/) {
	81	#High Detail
	82	next if $ExpandedString =~ /User \w+ Notification for Customer Experience Improvement Program/ and $Detail < 10;
	83	}
	84
	85	if ($System =~ /Virtual Disk Service/) {
	86	#High Detail
	87	next if $ExpandedString =~ /Service (started\|stopped)/ and $Detail < 10;
62	88	}
63	89
64	90	if ($System =~ /Service Control Manager/) {

+18

-0

scripts/services/kernel less more

53	53
54	54	my $Detail = $ENV{'LOGWATCH_DETAIL_LEVEL'} \|\| 0;
55	55	my $Ignore_faults = $ENV{'ignore_faults'};
	56	my $Ignore_rpcsec_expired = $ENV{'ignore_rpcsec_expired'} \|\| 0;
56	57	my %SYNflood = ();
57	58	my %RAIDErrors = ();
58	59	my %SegFaults = ();
59	60	my %GPFaults = ();
	61	my %TrapInt3s = ();
60	62	my %UnalignedErrors = ();
61	63	my %FPAssists = ();
62	64	my %OOM = ();

87	89	$SegFaults{$1}++;
88	90	} elsif ($ThisLine =~ /([^(]*)\[\d+\] general protection/) {
89	91	$GPFaults{$1}++;
	92	} elsif ($ThisLine =~ /([^(]*)\[\d+\] trap int3 /) {
	93	$TrapInt3s{$1}++;
90	94	} elsif ($ThisLine =~ /([^(]*)$\d+$: unaligned access to/) {
91	95	$UnalignedErrors{$1}++;
92	96	} elsif ($ThisLine =~ /([^(]*)$\d+$: floating-point assist fault at ip/) {

104	108	# These are informative, not errors
105	109	$SkipError = 1 if $ThisLine =~ /PCIe errors handled by OS/;
106	110	$SkipError = 1 if $ThisLine =~ /GHES: Generic hardware error source: \d notified via .* is not supported/;
	111	# These happen when kerberos tickets expire, which can be normal
	112	$SkipError = 1 if $ThisLine =~ /Error: state manager encountered RPCSEC_GSS session expired against NFSv4 server/ && $Ignore_rpcsec_expired;
107	113	$Errors{$errormsg}++ if ( (! $SkipError) \|\| ($Detail > 8));
108	114	}
109	115	# OTHER

161	167	}
162	168	}
163	169
	170	if (keys %TrapInt3s) {
	171	my $header_printed=0;
	172	foreach my $Thisone ( sort {$a cmp $b} keys %TrapInt3s ) {
	173	if ($Ignore_faults =~ /\b\Q$Thisone\E\b/i) { next; }
	174	if (!$header_printed) {
	175	print "\nWARNING: Trap int3 in these executables\n";
	176	$header_printed=1;
	177	}
	178	print " $Thisone : $TrapInt3s{$Thisone} Time(s)\n";
	179	}
	180	}
	181
164	182	if (keys %UnalignedErrors) {
165	183	print "\nWARNING: Unaligned Errors in these executables\n";
166	184	foreach my $Thisone ( sort {$a cmp $b} keys %UnalignedErrors ) {

+49

-34

scripts/services/puppet less more

18	18	## copyright please contact logwatch-devel@logwatch.org.
19	19	#########################################################
20	20
21		# Detail level is currently not used
	21	# Detail level
22	22	$Detail = $ENV{'LOGWATCH_DETAIL_LEVEL'} \|\| 0;
	23
	24	# Config
	25	my $offline = $ENV{'puppet_offline_ok'};
23	26
24	27	# Init counters
25	28	$FailedRuns = 0;

41	44	($ThisLine =~ /Caught HUP; calling restart/) or
42	45	($ThisLine =~ /Skipping because of failed dependencies/) or
43	46	($ThisLine =~ /Failed to generate additional resources/) or
44		($ThisLine =~ /Could not retrieve catalog from remote server/) or
	47	($ThisLine =~ /Could not evaluate: getaddrinfo: Name or service not known/) or
45	48	($ThisLine =~ /replacing from source .+ with contents /) or
46	49	($ThisLine =~ /Starting catalog run/) or
47	50	($ThisLine =~ /Applying configuration version/) or
48	51	($ThisLine =~ /Loading facts in/) or
49		($ThisLine =~ /Retrieving plugin/)
	52	($ThisLine =~ /Retrieving plugin/) or
	53	($ThisLine =~ /FileBucket adding/)
50	54	) {
51	55	# Ignore
	56	} elsif (($reason) = ($ThisLine =~ /Could not retrieve catalog from remote server: (.*)/)) {
	57	if ($reason == "getaddrinfo: Name or service not known" && $offline) {
	58	$FailedRuns--;
	59	} else {
	60	$CatalogFailures{$reason}++;
	61	}
52	62	} elsif ($ThisLine =~ /Finished catalog run in [0-9]+\.[0-9]+ seconds/) {
53	63	$SuccessfulRuns++;
54	64	} elsif ($ThisLine =~ /skipping run/) {
55	65	$FailedRuns++;
56		} elsif ($ThisLine =~ /File\[.+\].+checksum changed/) {
57		$ThisLine =~ /File\[(.+)\].+checksum changed/;
	66	} elsif ($ThisLine =~ /File\[(.+)\].+checksum changed/) {
58	67	$ChangedFiles{$1}++;
59		} elsif ($ThisLine =~ /File\[.+\].+content changed/) {
60		$ThisLine =~ /File\[(.+)\].+content changed/;
	68	} elsif ($ThisLine =~ /File\[(.+)\].+content changed/) {
61	69	$ChangedFiles{$1}++;
62		} elsif ($ThisLine =~ /File\[.+\].+created/) {
63		$ThisLine =~ /File\[(.+)\].+created/;
	70	} elsif ($ThisLine =~ /File\[(.+)\].+created/) {
64	71	$CreatedFiles{$1}++;
65		} elsif ($ThisLine =~ /File\[.+\].+removed/) {
66		$ThisLine =~ /File\[(.+)\].+removed/;
	72	} elsif ($ThisLine =~ /File\[(.+)\].+removed/) {
67	73	$RemovedFiles{$1}++;
	74	} elsif (($fileinfo) = ($ThisLine =~ /Filebucketed (.*)/)) {
	75	$FileBucketed{$1}++;
68	76	} elsif (
69	77	($ThisLine =~ /Failed to retrieve current state of resource/) or
70	78	($ThisLine =~ /Package.+ensure.+Could not find package/) or

72	80	($ThisLine =~ /File\[.+\].+ No specified sources exist/)
73	81	) {
74	82	$ResourceFailures++;
75		} elsif ($ThisLine =~ /Package\[.+\].+ensure changed/) {
76		$ThisLine =~ /Package\[(.+)\].+ensure changed/;
	83	} elsif ($ThisLine =~ /Package\[(.+)\].+ensure changed/) {
77	84	$ChangedPackages{$1}++;
78		} elsif ($ThisLine =~ /Package\[.+\].+ensure\) created/) {
79		$ThisLine =~ /Package\[(.+)\].+ensure\) created/;
	85	} elsif ($ThisLine =~ /Package\[(.+)\].+ensure\) created/) {
80	86	$InstalledPackages{$1}++;
81		} elsif ($ThisLine =~ /Package\[.+\].+ensure\) removed/) {
82		$ThisLine =~ /Package\[(.+)\].+ensure\) removed/;
	87	} elsif ($ThisLine =~ /Package\[(.+)\].+ensure\) removed/) {
83	88	$RemovedPackages{$1}++;
84		} elsif ($ThisLine =~ /Exec\[.+\].+executed successfully/) {
85		$ThisLine =~ /Exec\[(.+)\].+executed successfully/;
	89	} elsif ($ThisLine =~ /Exec\[(.+)\].+executed successfully/) {
86	90	$ExecRuns{$1}++;
87		} elsif ($ThisLine =~ /Exec\[.+\].+Triggering 'refresh' from [0-9]+ dependencies/) {
88		$ThisLine =~ /Exec\[(.+)\].+Triggering 'refresh' from [0-9]+ dependencies/;
	91	} elsif ($ThisLine =~ /Exec\[(.+)\].+Triggering 'refresh' from [0-9]+ dependencies/) {
89	92	$ExecRuns{$1}++;
90		} elsif ($ThisLine =~ /Service\[.+\].+ensure changed \'.+\' to \'running\'/) {
91		$ThisLine =~ /Service\[(.+)\].+ensure changed \'.+\' to \'running\'/;
	93	} elsif ($ThisLine =~ /Service\[(.+)\].+ensure changed \'.+\' to \'running\'/) {
92	94	$ServiceStarts{$1}++;
93		} elsif ($ThisLine =~ /Service\[.+\].+Triggering 'refresh' from [0-9]+ dependencies/) {
94		$ThisLine =~ /Service\[(.+)\].+Triggering 'refresh' from [0-9]+ dependencies/;
	95	} elsif ($ThisLine =~ /Service\[(.+)\].+Triggering 'refresh' from [0-9]+ dependencies/) {
95	96	$ServiceStarts{$1}++;
96	97	} elsif ($ThisLine =~ /Dependency .+\[.+\] has [0-9]+ failure/) {
97	98	$DependencyFailures++;

111	112	print "\nFailed runs: $FailedRuns\n";
112	113	}
113	114
	115	if (keys %CatalogFailures) {
	116	print "\nCould not retrieve catalog from remote server:\n";
	117	foreach $ThisOne (keys %CatalogFailures) {
	118	print " $ThisOne: $CatalogFailures{$ThisOne} Time(s)\n";
	119	}
	120	}
	121
114	122	if (keys %CreatedFiles) {
115	123	print "\nCreated files:\n";
116	124	foreach $ThisOne (keys %CreatedFiles) {
117		print "$ThisOne: $CreatedFiles{$ThisOne} Time(s)\n";
	125	print " $ThisOne: $CreatedFiles{$ThisOne} Time(s)\n";
118	126	}
119	127	}
120	128
121	129	if (keys %ChangedFiles) {
122	130	print "\nChanged files:\n";
123	131	foreach $ThisOne (keys %ChangedFiles) {
124		print "$ThisOne: $ChangedFiles{$ThisOne} Time(s)\n";
	132	print " $ThisOne: $ChangedFiles{$ThisOne} Time(s)\n";
125	133	}
126	134	}
127	135
128	136	if (keys %RemovedFiles) {
129	137	print "\nRemoved files:\n";
130	138	foreach $ThisOne (keys %RemovedFiles) {
131		print "$ThisOne: $RemovedFiles{$ThisOne} Time(s)\n";
	139	print " $ThisOne: $RemovedFiles{$ThisOne} Time(s)\n";
	140	}
	141	}
	142
	143	if (keys %FileBucketed and $Detail >= 5) {
	144	print "\nFileBucketed files:\n";
	145	foreach $ThisOne (keys %FileBucketed) {
	146	print " $ThisOne\n";
132	147	}
133	148	}
134	149
135	150	if (keys %InstalledPackages) {
136	151	print "\nInstalled packages:\n";
137	152	foreach $ThisOne (keys %InstalledPackages) {
138		print "$ThisOne: $InstalledPackages{$ThisOne} Time(s)\n";
	153	print " $ThisOne: $InstalledPackages{$ThisOne} Time(s)\n";
139	154	}
140	155	}
141	156
142	157	if (keys %ChangedPackages) {
143	158	print "\nChanged packages:\n";
144	159	foreach $ThisOne (keys %ChangedPackages) {
145		print "$ThisOne: $ChangedPackages{$ThisOne} Time(s)\n";
	160	print " $ThisOne: $ChangedPackages{$ThisOne} Time(s)\n";
146	161	}
147	162	}
148	163
149	164	if (keys %RemovedPackages) {
150	165	print "\nRemoved packages:\n";
151	166	foreach $ThisOne (keys %RemovedPackages) {
152		print "$ThisOne: $RemovedPackages{$ThisOne} Time(s)\n";
	167	print " $ThisOne: $RemovedPackages{$ThisOne} Time(s)\n";
153	168	}
154	169	}
155	170
156	171	if (keys %ExecRuns) {
157	172	print "\nExec runs:\n";
158	173	foreach $ThisOne (keys %ExecRuns) {
159		print "$ThisOne: $ExecRuns{$ThisOne} Time(s)\n";
	174	print " $ThisOne: $ExecRuns{$ThisOne} Time(s)\n";
160	175	}
161	176	}
162	177
163	178	if (keys %ServiceStarts) {
164	179	print "\nService starts:\n";
165	180	foreach $ThisOne (keys %ServiceStarts) {
166		print "$ThisOne: $ServiceStarts{$ThisOne} Time(s)\n";
	181	print " $ThisOne: $ServiceStarts{$ThisOne} Time(s)\n";
167	182	}
168	183	}
169	184

178	193	if (keys %OtherList) {
179	194	print "\nUnmatched Entries\n";
180	195	foreach $ThisOne (keys %OtherList) {
181		print "$ThisOne: $OtherList{$ThisOne} Time(s)\n";
	196	print " $ThisOne: $OtherList{$ThisOne} Time(s)\n";
182	197	}
183	198	}
184	199

-1

scripts/services/sendmail less more

1759	1759	print "\n Total per host: $TotalAbuse" if ($Detail >= 5);
1760	1760	$TotalError[$ErrorIndex] += $TotalAbuse;
1761	1761	}
1762		print "\n\tTota: l $TotalError[$ErrorIndex]" if ($Detail >= 3);
	1762	print "\n\tTotal: $TotalError[$ErrorIndex]" if ($Detail >= 3);
1763	1763	}
1764	1764	$TotalError[++$ErrorIndex] = 0;
1765	1765

+17

-0

scripts/services/spamassassin less more

40	40
41	41	my $Detail = $ENV{'LOGWATCH_DETAIL_LEVEL'} \|\| 0;
42	42	my $Debug = $ENV{'LOGWATCH_DEBUG'} \|\| 0;
	43	my $Ignore_connections = $ENV{'ignore_connections'};
43	44
44	45	$StillRoot = 0;
45	46	$CleanTotal = 0;

49	50	my %Clean;
50	51	my %Spam;
51	52	my %Users;
	53	my %Connections;
52	54
53	55	#Todo
54	56	# meta test DIGEST_MULTIPLE has undefined dependency 'DCC_CHECK' : 2 Time(s)

73	75	( $ThisLine =~ m/^server successfully spawned child process, / ) or
74	76	( $ThisLine =~ m/^removing stderr method/ ) or
75	77	( $ThisLine =~ m/^server pid:/ ) or
	78	( $ThisLine =~ m/^adjust: \d+ idle children (less\|more) than \d+ (min\|max)imum idle children/ ) or
76	79	0 # Always last in the list, so all above can say "or" at the end
77	80	) {
78	81	; # We don't care about these

84	87	$Users{ $User}++;
85	88	} elsif ( $ThisLine =~ m/still running as root: / ) {
86	89	$StillRoot++;
	90	} elsif ( $ThisLine =~ m/^connection from (.*) at port / ) {
	91	$Connections{$1}++;
87	92	} elsif ( $ThisLine =~ m/\bchild\b/ ) {
88	93	chomp($ThisLine);
89	94	# Many perl errors report pseudo-line-numbers, e.g.

139	144	}
140	145	}
141	146
	147	if (keys %Connections) {
	148	my $header_printed = 0;
	149	foreach my $connection ( sort {$a cmp $b} keys %Connections ) {
	150	if ($Ignore_connections && $connection =~ /$Ignore_connections/) { next; }
	151	if (!$header_printed) {
	152	print "\nConnections from:\n";
	153	$header_printed = 1;
	154	}
	155	print " $connection : $Connections{$connection} Time(s)\n";
	156	}
	157	}
	158
142	159	if (keys %OtherList) {
143	160	print "\nUnmatched Entries\n";
144	161	foreach $line (sort {$OtherList{$b}<=>$OtherList{$a} } keys %OtherList) {

59	59	next if $ExpandedString =~ /Microsoft \(R\) Windows \(R\) \d+\.\d+\. \d+ Service Pack \d/;
60	60	next if $ExpandedString =~ /The Event log service was started./;
61	61	next if $ExpandedString =~ /The Event log service was stopped./;
	62	next if $ExpandedString =~ /The system uptime is \d+ seconds/;
	63	}
	64
	65	if ($System =~ /Microsoft-Windows-Kernel-Power/) {
	66	#High Detail
	67	next if $ExpandedString =~ /The system is entering sleep/ and $Detail < 10;
	68	}
	69
	70	if ($System =~ /Microsoft-Windows-Power-Troubleshooter/) {
	71	#High Detail
	72	next if $ExpandedString =~ /The system has resumed from sleep/ and $Detail < 10;
	73	}
	74
	75	if ($System =~ /Microsoft-Windows-Time-Service/) {
	76	#High Detail
	77	next if $ExpandedString =~ /The time provider NtpClient is currently receiving valid time data from/ and $Detail < 10;
	78	}
	79
	80	if ($System =~ /Microsoft-Windows-Winlogon/) {
	81	#High Detail
	82	next if $ExpandedString =~ /User \w+ Notification for Customer Experience Improvement Program/ and $Detail < 10;
	83	}
	84
	85	if ($System =~ /Virtual Disk Service/) {
	86	#High Detail
	87	next if $ExpandedString =~ /Service (started\|stopped)/ and $Detail < 10;
62	88	}
63	89
64	90	if ($System =~ /Service Control Manager/) {