./0040755000000000000000000000000013040505236007713 5ustar rootrootinstall/0040755000000000000000000000000013040505236011224 5ustar rootrootinstall/doinst.sh0100644000000000000000000000034613040505236013060 0ustar rootroot( cd etc/cron.daily ; rm -rf 0logwatch ) ( cd etc/cron.daily ; ln -sf /usr/share/logwatch/scripts/logwatch.pl 0logwatch ) ( cd usr/sbin ; rm -rf logwatch ) ( cd usr/sbin ; ln -sf /usr/share/logwatch/scripts/logwatch.pl logwatch ) install/slack-desc0100644000000000000000000000162213040505236013156 0ustar rootroot# HOW TO EDIT THIS FILE: # The "handy ruler" below makes it easier to edit a package description. Line # up the first '|' above the ':' following the base package name, and the '|' # on the right side marks the last column you can put a character in. You must # make exactly 11 lines for the formatting to be correct. It's also # customary to leave one space after the ':'. |-----handy-ruler------------------------------------------------------| logwatch: logwatch (a customizable log analysis system) logwatch: logwatch: Logwatch parses through your system's logs for a given period of logwatch: time and creates a report analyzing areas that you specify, in as logwatch: much detail as you require. Logwatch is easy to use and will work logwatch: right out of the package on most systems. logwatch: logwatch: logwatch: logwatch: logwatch home: http://sourceforge.net/projects/logwatch/ logwatch: etc/0040755000000000000000000000000013040505236010331 5ustar rootrootetc/logwatch/0040755000000000000000000000000013040505236012141 5ustar rootrootetc/logwatch/conf/0040755000000000000000000000000013040505236013066 5ustar rootrootetc/logwatch/conf/override.conf0100644000000000000000000000011513040505236015546 0ustar rootroot# Configuration overrides for specific logfiles/services may be placed here. etc/logwatch/conf/logfiles/0040755000000000000000000000000013040505236014672 5ustar rootrootetc/logwatch/conf/ignore.conf0100644000000000000000000000012113040505236015207 0ustar rootroot###### REGULAR EXPRESSIONS IN THIS FILE WILL BE TRIMMED FROM REPORT OUTPUT ##### etc/logwatch/conf/services/0040755000000000000000000000000013040505236014711 5ustar rootrootetc/logwatch/conf/logwatch.conf0100644000000000000000000000014713040505236015544 0ustar rootroot# Local configuration options go here (defaults are in /usr/share/logwatch/default.conf/logwatch.conf) etc/logwatch/scripts/0040755000000000000000000000000013040505236013630 5ustar rootrootetc/logwatch/scripts/services/0040755000000000000000000000000013040505236015453 5ustar rootrootetc/cron.daily/0040755000000000000000000000000013040505236012373 5ustar rootrootvar/0040755000000000000000000000000013040505236010346 5ustar rootrootvar/cache/0040755000000000000000000000000013040505236011411 5ustar rootrootvar/cache/logwatch/0040755000000000000000000000000013040505236013221 5ustar rootrootusr/0040755000000000000000000000000013040505236010367 5ustar rootrootusr/share/0040755000000000000000000000000013040505236011471 5ustar rootrootusr/share/logwatch/0040755000000000000000000000000013040505236013301 5ustar rootrootusr/share/logwatch/dist.conf/0040755000000000000000000000000013040505236015170 5ustar rootrootusr/share/logwatch/dist.conf/logfiles/0040755000000000000000000000000013040505236016774 5ustar rootrootusr/share/logwatch/dist.conf/services/0040755000000000000000000000000013040505236017013 5ustar rootrootusr/share/logwatch/lib/0040755000000000000000000000000013040505236014047 5ustar rootrootusr/share/logwatch/lib/Logwatch.pm0100755000000000000000000004434713040505236016171 0ustar rootroot#!/usr/bin/perl # # $Id$ package Logwatch; use strict; use Exporter; use POSIX qw(strftime); =pod =head1 NAME Logwatch -- Utility functions for Logwatch Perl modules. =head1 SYNOPSIS use Logwatch ':sort'; ## ## Show CountOrder() ## # Sample Data my %UnknownUsers = (jb1o => 4, eo00 => 1, ma3d => 4, dr4b => 1); my $sortClosure = CountOrder(%UnknownUsers); foreach my $user (sort $sortClosure keys %UnknownUsers) { my $plural = ($UnknownUsers{$user} > 1) ? "s" : ""; printf " %-8s : %2d time%s\n", $user, $UnknownUsers{$user}, $plural; } ## ## Show TotalCountOrder() ## # Sample Data my %RelayDenied = ( some.server => {you@some.where => 2, foo@bar.com => 4}, other.server => { foo@bar.com => 14 } ); my $sub = TotalCountOrder(%RelayDenied); foreach my $relay (sort $sub keys %RelayDenied) { print " $relay:\n"; my $countOrder = CountOrder(%{$RelayDenied{$relay}}); foreach my $dest (sort $countOrder keys %{$RelayDenied{$relay}}) { my $plural = ($RelayDenied{$relay}{$dest} > 1) ? "s" : ""; printf " %-36s: %3d Time%s\n", $dest, $RelayDenied{$relay}{$dest}, $plural; } } use Logwatch ':ip'; ## ## Show SortIP() ## # Sample Data @ReverseFailures = qw{10.1.1.1 172.16.1.1 10.2.2.2 192.168.1.1 }; @ReverseFailures = sort SortIP @ReverseFailures; { local $" = "\n "; print "Reverse DNS Failures:\n @ReverseFailures\n" } -or- ## ## Show LookupIP() ## foreach my $ip (sort SortIP @ReverseFailures) { printf "%15s : %s\n", $ip, LookupIP($ip); } =head1 DESCRIPTION This module provides utility functions intended for authors of Logwatch scripts. The purpose is to abstract commonly performed actions into a set of generally available subroutines. The subroutines can optionally be imported into the local namespace. =over 4 =cut our @ISA = qw{Exporter}; our @EXPORT; our @EXPORT_OK; our %EXPORT_TAGS = (sort => [qw(CountOrder TotalCountOrder SortIP)], ip => [qw(LookupIP SortIP)], dates => [qw(RangeHelpDM GetPeriod TimeBuild TimeFilter)], ); Exporter::export_ok_tags(qw{sort ip dates}); $EXPORT_TAGS{all} = [@EXPORT, @EXPORT_OK]; =pod =item I This function returns a closure suitable to be passed to Perl's C builtin. When two values are passed to the closure, it compares the numeric values of those keys in C<%hash>, and if they're equal, the lexically order of the keys. Thus: my $sortClosure = CountOrder(%UnknownUsers); foreach my $user (sort $sortClosure keys %UnknownUsers) { my $plural = ($UnknownUsers{$user} > 1) ? "s" : ""; printf " %-8s : %2d time%s\n", $user, $UnknownUsers{$user}, $plural; } Will print the keys and values of C<%UnknownUsers> in frequency order, with keys of equal values sorted lexically. The optional second argument is a coderef to be used to sort the keys in an order other than lexically. (a reference to C, for example.) =cut # Use a closure to abstract the sort algorithm sub CountOrder(\%;&) { my $href = shift; my $coderef = shift; return sub { # $a & $b are in the caller's namespace, moving this inside # guarantees that the namespace of the sort is used, in case # it's different (admittedly, that's highly unlikely), at a # miniscule performance cost. my $package = (caller)[0]; no strict 'refs'; # Back off, man. I'm a scientist. my $A = $ {"${package}::a"}; my $B = $ {"${package}::b"}; use strict 'refs'; # We are a hedge. Please move along. # Reverse the count, but not the compare my $count = $href->{$B} <=> $href->{$A}; return $count if $count; if (ref $coderef) { $a = $A; $b = $B; &$coderef(); } else { ($A cmp $B); } } } =pod =item I This function returns a closure similar to that returned by C, except that it assumes a hash of hashes, and totals the keys of each sub hash. Thus: my $sub = TotalCountOrder(%RelayDenied); foreach my $relay (sort $sub keys %RelayDenied) { print " $relay:\n"; my $countOrder = CountOrder(%{$RelayDenied{$relay}}); foreach my $dest (sort $countOrder keys %{$RelayDenied{$relay}}) { my $plural = ($RelayDenied{$relay}{$dest} > 1) ? "s" : ""; printf " %-36s: %3d Time%s\n", $dest, $RelayDenied{$relay}{$dest}, $plural; } } Will print the relays in the order of their total denied destinations (equal keys sort lexically), with each sub hash printed in frequency order (equal keys sorted lexically) The optional second argument is a coderef to be used to sort the keys in an order other than lexically. (a reference to C, for example.) =cut sub TotalCountOrder(\%;&) { my $href = shift; my $coderef = shift; my $cache = {}; return sub { # $a & $b are in the caller's namespace, moving this inside # guarantees that the namespace of the sort is used, in case # it's different (admittedly, that's highly unlikely), at a # miniscule performance cost. my $package = (caller)[0]; no strict 'refs'; # Back off, man. I'm a scientist. my $A = $ {"${package}::a"}; my $B = $ {"${package}::b"}; use strict 'refs'; # We are a hedge. Please move along. my ($AA, $BB); foreach my $tuple ( [\$A, \$AA], [\$B, \$BB] ) { my $keyRef = $tuple->[0]; my $totalRef = $tuple->[1]; if (exists($cache->{$$keyRef})) { $$totalRef = $cache->{$$keyRef}; } else { grep {$$totalRef += $href->{$$keyRef}->{$_}} keys %{$href->{$$keyRef}}; $cache->{$$keyRef} = $$totalRef; } } my $count = $BB <=> $AA; return $count if $count; if (ref $coderef) { $a = $A; $b = $B; &$coderef(); } else { ($A cmp $B); } } } =pod =item I This function is meant to be passed to the perl C builtin. It sorts a list of "dotted quad" IP addresses by the values of the individual octets. =cut sub canonical_ipv6_address { my @a = split /:/, shift; my @b = qw(0 0 0 0 0 0 0 0); my $i = 0; # comparison is numeric, so we use hex function while (defined $a[0] and $a[0] ne '') {$b[$i++] = hex(shift @a);} @a = reverse @a; $i = 7; while (defined $a[0] and $a[0] ne '') {$b[$i--] = hex(shift @a);} @b; } sub SortIP { # $a & $b are in the caller's namespace. my $package = (caller)[0]; no strict 'refs'; # Back off, man. I'm a scientist. my $A = $ {"${package}::a"}; my $B = $ {"${package}::b"}; $A =~ s/^::(ffff:)?(\d+\.\d+\.\d+\.\d+)$/$2/; $B =~ s/^::(ffff:)?(\d+\.\d+\.\d+\.\d+)$/$2/; use strict 'refs'; # We are a hedge. Please move along. if ($A =~ /:/ and $B =~ /:/) { my @a = canonical_ipv6_address($A); my @b = canonical_ipv6_address($B); while ($a[1] and $a[0] == $b[0]) {shift @a; shift @b;} $a[0] <=> $b[0]; } elsif ($A =~ /:/) { -1; } elsif ($B =~ /:/) { 1; } else { my ($a1, $a2, $a3, $a4) = split /\./, $A; my ($b1, $b2, $b3, $b4) = split /\./, $B; $a1 <=> $b1 || $a2 <=> $b2 || $a3 <=> $b3 || $a4 <=> $b4; } } =pod =item I This function performs a hostname lookup on a passed in IP address. It returns the hostname (with the IP in parentheses) on success and the IP address on failure. Results are cached, so that many calls with the same argument don't tax the resolver resources. For (new) backward compatibility, this function now uses the $DoLookup variable in the caller's namespace to determine if lookups will be made. =cut # Might as well cache it for the duration of the run my %LookupCache = (); sub LookupIP { my $Addr = $_[0]; # OOPS! The 4.3.2 scripts have a $DoLookup variable. Time for some # backwards compatible hand-waving. # for 99% of the uses of this function, assuming package 'main' would # be sufficient, but a good perl hacker designs so that the other 1% # isn't in for a nasty suprise. my $pkg = (caller)[0]; if ($ENV{'LOGWATCH_NUMERIC'} == 1 ) { return $Addr; } # Default to true my $DoLookup = 1; { # An eval() here would be shorter (and probably clearer to more # people), but QUITE a bit slower. This function should be # designed to be called a lot, so efficiency is important. local *symTable = $main::{"$pkg\::"}; # here comes the "black magic," (this "no" is bound to the # enclosing block) no strict 'vars'; if (exists $symTable{'DoLookup'} && defined $symTable{'DoLookup'}) { *symTable = $symTable{'DoLookup'}; $DoLookup = $symTable; } } # "Socket" is used solely to get the AF_INET() and AF_INET6() # constants, usually 2 and 10, respectively. Using Socket is # preferred because of portability, and should be in the standard # Perl distribution. eval "use Socket"; my $hasSocket = $@? 0 : 1; return $Addr unless($DoLookup && $hasSocket); return $LookupCache{$Addr} if exists ($LookupCache{$Addr}); $Addr =~ s/^::ffff://; my $PackedAddr; my $name = ""; # there are other module functions that do this more gracefully # (such as inet_pton), but we can't guarantee that they are available # in every system, so we use the built-in gethostbyaddr. if ($Addr =~ /^[\d\.]*$/) { $PackedAddr = pack('C4', split /\./,$Addr); $name = gethostbyaddr($PackedAddr,AF_INET()); } elsif ($Addr =~ /^[0-9a-zA-Z:]*/) { $PackedAddr = pack('n8', canonical_ipv6_address($Addr)); $name = gethostbyaddr($PackedAddr, AF_INET6()); } if ($name) { my $val = "$Addr ($name)"; $LookupCache{$Addr} = $val; return $val; } else { $LookupCache{$Addr} = $Addr; return ($Addr); } } =pod =item I This function merely prints out some information about --range to STDERR. =cut sub RangeHelpDM { eval "use Date::Manip"; my $hasDM = $@ ? 0 : 1; if ($hasDM) { print STDERR "\nThis system has the Date::Manip module loaded, and therefore you may use all\n"; print STDERR "of the valid --range parameters.\n"; } else { print STDERR "\nThis system does not have Date::Manip module loaded, and therefore\n"; print STDERR "the only valid --range parameters are \"yesterday\", \"today\", or \"all\".\n"; print STDERR "The Date::Manip module can be installed by using either of:\n"; print STDERR " apt-get install libdate-manip-perl (recommended on Debian)'\n"; print STDERR " cpan -i 'Date::Manip'\n"; print STDERR " perl -MCPAN -e 'install Date::Manip'\n"; print STDERR "\nFollowing is a description of the full capabilities available if\n"; print STDERR "Date::Manip is available.\n"; } print STDERR <<"EOT"; The format of the range option is: --range \"date_range [period]\" Parameter date_range (and optional period) must be enclosed in double quotes if it is more than one word. The default for date_range is \"yesterday\". Valid instances of date_range have one of the following formats: yesterday today all date1 between date1 and date2 since date1 For the above, date1 and date2 have values that can be parsed with the Date::Manip perl module. Valid instances of the optional parameter period have one of the following formats: for (that|this) (year|month|day|hour|minute|second) for those (years|months|days|hours|minutes|seconds) The period defines the resolution of the date match. The default is \"for that day\". Examples: --range today --range yesterday --range \"4 hours ago for that hour\" --range \"-3 days\" --range \"since 2 hours ago for those hours\" --range \"between -10 days and -2 days\" --range \"Apr 15, 2005\" --range \"first Monday in May\" --range \"between 4/23/2005 and 4/30/2005\" --range \"2005/05/03 10:24:17 for that second\" (The last entry might be used by someone debugging a log or filter.) A caution about efficiency: a range of \"yesterday for those hours\" will search for log entries for the last 24 hours, and is innefficient because it searches for individual matches for each hour. A range of \"yesterday\" will search for log entries for the previous day, and it searches for a single date match. EOT ; } =pod =item I This function returns the period, which is the part after the "for (those|that|this) " in a range =cut sub GetPeriod { my $range = lc $ENV{"LOGWATCH_DATE_RANGE"} || "yesterday"; my ($period) = ($range =~ /for\s+(?:those|that|this)\s+(year|month|day|hour|minute|second)s?\s*$/); if ($range eq 'all') { $period = 'all'; } unless ($period) { $period = "day"; } return($period); } =pod =item I This function returns an array of integers denoting time since the epoch (Jan. 1, 1970). Each entry represents a timestamp for the period that will that will need to be looked up to create the filter. =cut sub TimeBuild { my @time_t; my $time = time; eval "use Date::Manip"; my $hasDM = $@ ? 0 : 1; if ($hasDM) { eval 'Date_TimeZone();'; if ($@) { die "ERROR: Date::Manip unable to determine TimeZone.\n\nExecute the following command in a shell prompt:\n\tperldoc Date::Manip\nThe section titled TIMEZONES describes valid TimeZones\nand where they can be defined.\n"; } } my $range = lc $ENV{"LOGWATCH_DATE_RANGE"} || "yesterday"; my $period = GetPeriod; $range =~ s/for\s+(?:those|that|this)\s+((year|month|day|hour|minute|second)s?)\s*$//; my ($range1, $range2) = ($range =~ /^between\s+(.*)\s+and\s+(.*)\s*$/); if ($range =~ /^\s*since\s+/) { ($range1) = ($range =~ /\s*since\s+(.*)/); $range2 = "now"; } if ($range1 && $range2 && $hasDM) { # range between two dates specified my $date1 = ParseDate($range1); my $date2 = ParseDate($range2); if ($date1 && $date2) { if (Date_Cmp($date1, $date2) > 0) { # make sure date1 is earlier my $switch_date = $date1; $date1 = $date2; $date2 = $switch_date; } while (Date_Cmp($date1, $date2) < 0) { $time_t[++$#time_t] = UnixDate($date1, "%s"); $date1 = DateCalc($date1, "+1 $period"); } $time_t[++$#time_t] = UnixDate($date2, "%s"); } else { # $date1 or $date2 not valid # set to zero, which indicates it is not parsed $time_t[0] = 0; } } else { # either a single date or we don't have Date::Manip if ($range eq 'yesterday') { $time_t[0] = $time-86400; } elsif ($range eq 'today') { $time_t[0] = $time; } elsif ($range eq 'all') { # set arbitrarily to 1 $time_t[0] = 1; } elsif ($hasDM) { $time_t[0] = UnixDate($range, "%s") || 0; } else { $time_t[0] = 0; } } # this is an optimization when we use Date::Manip, and # the period is either 'month' or 'year'. It is intended # to reduce the number of archived logs searched. # We use the second day of month or year to account for # different timezones. if ($time_t[0] && $hasDM) { my $mod_date = ParseDateString("epoch $time_t[0]"); if ($period =~ /^month|year$/) { # set to beginning of month $mod_date =~ s/\d\d\d\d:\d\d:\d\d$/0200:00:00/; if ($period =~ /^year$/) { # set to beginning of year $mod_date =~ s/\d\d0100:00:00/010200:00:00/; } } $time_t[0] = UnixDate($mod_date, "%s"); } return(@time_t); } =pod =item I This function returns a regexp to filter by date/time =cut sub TimeFilter { my ($format) = $_[0]; my $SearchDate; my $range = lc $ENV{"LOGWATCH_DATE_RANGE"} || "yesterday"; my $debug = $ENV{"LOGWATCH_DEBUG"} || 0; my @time_t = TimeBuild(); # get period my $period = GetPeriod; if ($debug > 5) { print STDERR "\nTimeFilter: Period is $period\n"; } # we need the following bracketed section because of 'last' { if ($period eq 'second') {last;} $format =~ s/%S/../; if ($period eq 'minute') {last;} $format =~ s/%M/../; if ($period eq 'hour') {last;} $format =~ s/%H/../; if ($period eq 'day') {last;} $format =~ s/%a/.../; $format =~ s/%d/../; $format =~ s/%e/../; if ($period eq 'month') {last;} $format =~ s/%b/.../; $format =~ s/%m/../; if ($period eq 'year') {last;} $format =~ s/%y/../; $format =~ s/%Y/..../; } $SearchDate .= "("; for my $time (@time_t) { if ($time) { $SearchDate .= strftime($format, localtime($time)) . "|"; } else { # the following is a string guaranteed to not match $SearchDate .= "Range \"$range\" not understood. "; print STDERR "ERROR: Range \"$range\" not understood\n"; RangeHelpDM; } } # get rid of last character (usually the extra "|") if (length($SearchDate) > 1) { chop($SearchDate); } $SearchDate .= ")"; if ($debug> 5) { # DebugSearchDate sometimes makes it more readable - not used # functionally my $DebugSearchDate = $SearchDate; $DebugSearchDate =~ tr/:/ /; $DebugSearchDate =~ tr/\./ /; $DebugSearchDate =~ tr/ //s; print STDERR "\nTimeFilter: SearchDate is $SearchDate\n"; print STDERR "\nTimeFilter: Debug SearchDate is $DebugSearchDate\n"; } return ($SearchDate); } =back =head1 TAGS In addition to importing each function name explicitly, the following tags can be used. =over 4 =item I<:sort> Imports C, C =item I<:ip> Imports C and C =item I<:dates> Imports C =item I<:all> Imports all importable symbols. =cut 1; # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/0040755000000000000000000000000013040505236015651 5ustar rootrootusr/share/logwatch/default.conf/logfiles/0040755000000000000000000000000013040505236017455 5ustar rootrootusr/share/logwatch/default.conf/logfiles/qmail-pop3d-current.conf0100644000000000000000000000105413040505236024127 0ustar rootroot########################################################################## # $Id$ ########################################################################## # $Log: qmail-pop3d-current.conf,v $ # Revision 1.1 2005/09/07 00:37:59 bjorn # New qmail multilog files written by Bob Hutchinson # ########################################################################## # What actual file? Defaults to LogPath if not absolute path.... LogFile = qmail/pop3d/@*.s LogFile = qmail/pop3d/current # Keep only the lines in the proper date range... *applytaidate usr/share/logwatch/default.conf/logfiles/cisco.conf0100644000000000000000000000170013040505236021417 0ustar rootroot########################################################################## # $Id$ ########################################################################## ######################################################## # This was written and is maintained by: # Laurent DUFOUR , # based on the work of # Kirk Bauer # # Please send all comments, suggestions, bug reports, # etc, to laurent.dufour@havas.com ######################################################## # What actual file? Defaults to LogPath if not absolute path.... LogFile = cisco.log # If the archives are searched, here is one or more line # (optionally containing wildcards) that tell where they are... Archive = cisco.log.* Archive = cisco.log-* # Expand the repeats (actually just removes them now) #*ExpandRepeats # Keep only the lines in the proper date range... #*ApplyStdDate # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/logfiles/resolver.conf0100644000000000000000000000542613040505236022171 0ustar rootroot############################################################################# # $Id$ ############################################################################# # $Log: resolver.conf,v $ # Revision 1.1 2005/10/19 05:57:40 bjorn # dnssec and resolver scripts, written by Lindy Foster # ############################################################################# #Copyright (c) 2004, Sparta, Inc #All rights reserved. # #Redistribution and use in source and binary forms, with or without #modification, are permitted provided that the following conditions are met: # #* Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # #* Redistributions in binary form must reproduce the above copyright # notice, this list of conditions and the following disclaimer in the # documentation and/or other materials provided with the distribution. # #* Neither the name of Sparta, Inc nor the names of its contributors may # be used to endorse or promote products derived from this software # without specific prior written permission. # #THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS ``AS #IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, #THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR #PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDERS OR #CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, #EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, #PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; #OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, #WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR #OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF #ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ############################################################################# ############################################################################# # These scripts were created as part of the dnssec-tools project. # For more information, see http://sourceforge.net/dnssec-tools. # Detailed instructions for setting up BIND 9.3.* to use these logwatch # configuration files and scripts are containted in the README file # on sourceforge. ############################################################################# ######################################################## # Define log file group for resolver ######################################################## # What actual file? Defaults to LogPath if not absolute path.... # only seems to work when log file is in /var/log LogFile = resolver # Expand the repeats (actually just removes them now) *ExpandRepeats # Keep only the lines in the proper date range... *ApplyBindDate usr/share/logwatch/default.conf/logfiles/imapd.conf0100644000000000000000000000052313040505236021413 0ustar rootroot # What actual file? Defaults to LogPath if not absolute path.... LogFile = imapd.log # If the archives are searched, here is one or more line # (optionally containing wildcards) that tell where they are... # Note: if these are gzipped, you need to end with a .gz even if # you use wildcards... Archive = imapd.log.*.gz *OnlyHost usr/share/logwatch/default.conf/logfiles/denyhosts.conf0100644000000000000000000000072313040505236022343 0ustar rootroot############################################################################### # $Id$ ############################################################################### # $Log: denyhosts.conf,v $ # Revision 1.1 2006/11/12 18:32:54 bjorn # New service denyhosts, by grubert. # ############################################################################### LogFile = denyhosts Archive = denyhosts.* Archive = denyhosts-* *ApplyEuroDate # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/logfiles/emerge.conf0100644000000000000000000000157613040505236021576 0ustar rootroot########################################################################## # $Id$ ########################################################################## ######################################################## # This was written and is maintained by: # Laurent DUFOUR , # based on the work of # Kirk Bauer # # Please send all comments, suggestions, bug reports, # etc, to laurent.dufour at havas.com ######################################################## # What actual file? Defaults to LogPath if not absolute path.... LogFile = emerge.log # If the archives are searched, here is one or more line # (optionally containing wildcards) that tell where they are... #If you use a "-" in naming add that as well -mgt Archive = emerge.log.* Archive = emerge.log-* #*ApplyUSDate # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/logfiles/tac_acc.conf0100644000000000000000000000062613040505236021702 0ustar rootroot# What actual file? Defaults to LogPath if not absolute path.... LogFile = tac_acc.log # If the archives are searched, here is one or more line # (optionally containing wildcards) that tell where they are... #If you use a "-" in naming add that as well -mgt Archive = tac_acc.log.* Archive = tac_acc.log-* # Keep only the lines in the proper date range... *ApplyStdDate # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/logfiles/daemon.conf0100644000000000000000000000167113040505236021571 0ustar rootroot########################################################################### # $Id$ ########################################################################### # $Log: daemon.conf,v $ # Revision 1.2 2007/10/01 16:55:18 mike # Removed OnlyHost config in these files. It was not working correctly and has been added in the main script when it is needed. -mgt # # Revision 1.1 2006/03/21 03:01:34 bjorn # Debian-specific log files, by Willi Mann. # ########################################################################### # daemon log file for debian-based systems LogFile = daemon.log LogFile = daemon.log.0 Archive = daemon.log.*.gz Archive = daemon.log-*.gz *ExpandRepeats *ApplyStdDate ########################################################################### # Please send all comments, suggestions, bug reports, # etc, to logwatch-devel@lists.sourceforge.net ########################################################################### usr/share/logwatch/default.conf/logfiles/netopia.conf0100644000000000000000000000176713040505236021773 0ustar rootroot########################################################################## # $Id$ ########################################################################## ######################################################## # This was written and is maintained by: # Laurent DUFOUR , # based on the work of # Kirk Bauer # # Please send all comments, suggestions, bug reports, # etc, to laurent.dufour@havas.com ######################################################## # What actual file? Defaults to LogPath if not absolute path.... LogFile = netopia.log # If the archives are searched, here is one or more line # (optionally containing wildcards) that tell where they are... #If you use a "-" in naming add that as well -mgt Archive = netopia.log.* Archive = netopia.log-* # Expand the repeats (actually just removes them now) #*ExpandRepeats # Keep only the lines in the proper date range... *ApplyStdDate # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/logfiles/postgresql.conf0100644000000000000000000000173413040505236022531 0ustar rootroot# Logfile definition for PostgreSQL #Prerequisite: if you are using stderr as PostgreSQL log_destination, you must at #least set log_line_prefix = '%t ' in the postgresql.conf file. # What actual file? Defaults to LogPath if not absolute path.... LogFile = postgresql/postgresql.log LogFile = postgresql/postgresql.log.1 LogFile = postgresql/postgresql-*.log LogFile = postgresql/postgresql-*.log.1 # If the archives are searched, here is one or more line # (optionally containing wildcards) that tell where they are... #If you use a "-" in naming add that as well -mgt Archive = postgresql/postgresql.log.*.gz Archive = postgresql/postgresql-*.log.*.gz # Expand the repeats (actually just removes them now) *ExpandRepeats ########################################################################### ## Please send all comments, suggestions, bug reports, ## etc, to logwatch-devel@lists.sourceforge.net ############################################################################ usr/share/logwatch/default.conf/logfiles/up2date.conf0100644000000000000000000000140313040505236021663 0ustar rootroot########################################################################## # $Id$ ########################################################################## ######################################################## # This was written and is maintained by: # Eric Moret # # Please send all comments, suggestions, bug reports, # etc, to eric.moret@epita.fr. ######################################################## # What actual file? Defaults to LogPath if not absolute path.... LogFile = up2date # If the archives are searched, here is one or more line # (optionally containing wildcards) that tell where they are... #If you use a "-" in naming add that as well -mgt Archive = up2date.* Archive = up2date-* # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/logfiles/autorpm.conf0100644000000000000000000000107613040505236022014 0ustar rootroot########################################################################## # $Id$ ########################################################################## ######################################################## # This was written and is maintained by: # Kirk Bauer # # Please send all comments, suggestions, bug reports, # etc, to kirk@kaybee.org. ######################################################## # What actual file? Defaults to LogPath if not absolute path.... LogFile = /var/spool/autorpm/install.log # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/logfiles/qmail-send-current.conf0100644000000000000000000000103713040505236024034 0ustar rootroot########################################################################## # $Id$ ########################################################################## # $Log: qmail-send-current.conf,v $ # Revision 1.1 2005/09/07 00:37:59 bjorn # New qmail multilog files written by Bob Hutchinson # ########################################################################## # What actual file? Defaults to LogPath if not absolute path.... LogFile = qmail/@*.s LogFile = qmail/current # Keep only the lines in the proper date range... *applytaidate usr/share/logwatch/default.conf/logfiles/maillog.conf0100644000000000000000000000215313040505236021746 0ustar rootroot########################################################################## # $Id$ ########################################################################## ######################################################## # This was written and is maintained by: # Kenneth Porter # # Please send all comments, suggestions, bug reports, # etc, to shiva@well.com. ######################################################## # What actual file? Defaults to LogPath if not absolute path.... LogFile = maillog LogFile = syslog LogFile = mail.log LogFile = mail.log.0 LogFile = mail # If the archives are searched, here is one or more line # (optionally containing wildcards) that tell where they are... #If you use a "-" in naming add that as well -mgt Archive = maillog.* Archive = maillog-* Archive = syslog.* Archive = syslog-* Archive = archiv/maillog.* Archive = archiv/maillog-* Archive = mail.log.*.gz Archive = mail.log-*.gz Archive = mail-* # Expand the repeats (actually just removes them now) *ExpandRepeats # Keep only the lines in the proper date range... *ApplyStdDate # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/logfiles/windows.conf0100644000000000000000000000202113040505236022006 0ustar rootroot########################################################################## # $Id$ ########################################################################## ########################################################################## # This was written and is maintained by: # William Roumier # # Please send all comments, suggestions, bug reports, # etc, to logwatch-devel@lists.sourceforge.net ########################################################################## # What actual file? Defaults to LogPath if not absolute path.... LogFile = windows.log # If the archives are searched, here is one or more line # (optionally containing wildcards) that tell where they are... # Note: if these are gzipped, you need to end with a .gz even if # you use wildcards... Archive = windows.log.* Archive = windows.log.*.gz Archive = windows.log-* Archive = windows.log-*.gz # Expand the repeats (actually just removes them now) *ExpandRepeats # Keep only the lines in the proper date range... *ApplyStdDate usr/share/logwatch/default.conf/logfiles/messages.conf0100644000000000000000000000216013040505236022127 0ustar rootroot########################################################################## # $Id$ ########################################################################## ######################################################## # This was written and is maintained by: # Kirk Bauer # # Please send all comments, suggestions, bug reports, # etc, to kirk@kaybee.org. ######################################################## # What actual file? Defaults to LogPath if not absolute path.... LogFile = messages # If the archives are searched, here is one or more line # (optionally containing wildcards) that tell where they are... #If you use a "-" in naming add that as well -mgt Archive = messages.* Archive = archiv/messages.* Archive = messages-* Archive = archiv/messages-* # Expand the repeats (actually just removes them now) *ExpandRepeats # Now, lets remove the services we don't care about at all... # Comma separated list works best -mgt *RemoveService = talkd,telnetd,inetd,nfsd,/sbin/mingetty,netscreen,NetScreen # Keep only the lines in the proper date range... *ApplyStdDate # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/logfiles/yum.conf0100644000000000000000000000020413040505236021127 0ustar rootroot# What actual file? Defaults to LogPath if not absolute path.... LogFile = yum.log #*ApplyUSDate # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/logfiles/audit_log.conf0100644000000000000000000000120513040505236022266 0ustar rootroot######################################################## # Define log file group for mod_security ######################################################## # Where the log files are - you will need to match this to your configuration # Note that a relative path like this will be expanded automatically to the # standard log path (e.g. /var/log/... ) LogFile = modsecurity2/modsec_audit.log # If the archives are searched, here is one or more line # (optionally containing wildcards) that tell where they are... # Note: if these are gzipped, you need to end with a .gz even if you use wildcards... Archive = modsecurity2/modsec_audit.log.* usr/share/logwatch/default.conf/logfiles/freeradius.conf0100644000000000000000000000123113040505236022447 0ustar rootroot########################################################################## # freeradius # Marczona # 28.12.2011 ########################################################################## # What actual file? Defaults to LogPath if not absolute path.... LogFile = freeradius/radius.log # If the archives are searched, here is one or more line # (optionally containing wildcards) that tell where they are... #If you use a "-" in naming add that as well -mgt Archive = freeradius/radius.log.* # Expand the repeats (actually just removes them now) #*ExpandRepeats # Keep only the lines in the proper date range... *ApplyStdDate # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/logfiles/mysql.conf0100644000000000000000000000077313040505236021475 0ustar rootroot######################################################## # Logfile definition for MySQL # File is to be placed in # /etc/logwatch/conf/logfiles/mysql.conf ######################################################## # What actual file? Defaults to LogPath if not absolute path.... LogFile = /var/log/mysql/mysqld.err.1 LogFile = /var/log/mysql/mysqld.err Archive = /var/log/mysql/mysqld.err.*.gz Archive = /var/log/mysql/mysqld.err-*.gz # Expand the repeats (actually just removes them now) *ExpandRepeats usr/share/logwatch/default.conf/logfiles/bfd.conf0100644000000000000000000000073213040505236021056 0ustar rootroot########################################################################## # $Id$ ########################################################################## # $Log: bfd.conf,v $ # Revision 1.1 2007/04/15 19:48:23 bjorn # New bfd (Brute Force Detection) service, by Andy Bolstridge. # ########################################################################## # Which logfile group... LogFile = /var/log/bfd_log Archive = /var/log/bfd_log.* Archive = /var/log/bfd_log-* usr/share/logwatch/default.conf/logfiles/netscreen.conf0100644000000000000000000000177513040505236022321 0ustar rootroot########################################################################## # $Id$ ########################################################################## ######################################################## # This was written and is maintained by: # Laurent DUFOUR , # based on the work of # Kirk Bauer # # Please send all comments, suggestions, bug reports, # etc, to laurent.dufour@havas.com ######################################################## # What actual file? Defaults to LogPath if not absolute path.... LogFile = netscreen.log # If the archives are searched, here is one or more line # (optionally containing wildcards) that tell where they are... #If you use a "-" in naming add that as well -mgt Archive = netscreen.log.* Archive = netscreen.log-* # Expand the repeats (actually just removes them now) #*ExpandRepeats # Keep only the lines in the proper date range... *ApplyStdDate # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/logfiles/extreme-networks.conf0100644000000000000000000000174013040505236023646 0ustar rootroot########################################################################## # $Id$ ########################################################################## ######################################################## # This was written and is maintained by: # Laurent DUFOUR , # based on the work of # Kirk Bauer # # Please send all comments, suggestions, bug reports, # etc, to laurent.dufour@havas.com ######################################################## # What actual file? Defaults to LogPath if not absolute path.... LogFile = extreme-networks.log # If the archives are searched, here is one or more line # (optionally containing wildcards) that tell where they are... Archive = extreme-networks.log.* Archive = extreme-networks.log-* # Expand the repeats (actually just removes them now) #*ExpandRepeats # Keep only the lines in the proper date range... *ApplyStdDate # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/logfiles/vdr.conf0100644000000000000000000000116413040505236021116 0ustar rootroot########################################################################## # $Id$ ########################################################################## ######################################################## # This was written and is maintained by: # Reiner Buehl # # Please send all comments, suggestions, bug reports, # etc, to reiner@buehl.net. ######################################################## # What actual file? Defaults to LogPath if not absolute path.... LogFile = vdr.log LogFile = vdr.log.0 Archive = vdr.log.*.gz *ExpandRepeats *ApplyStdDate # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/logfiles/php.conf0100644000000000000000000000247113040505236021114 0ustar rootroot############################################################################### # $Id$ ############################################################################### # $Log: php.conf,v $ # Revision 1.1 2006/11/12 18:28:31 bjorn # New php service, by Jeremias Reith. # ############################################################################### # This was written and is maintained by: # Jeremias Reith # # Please send all comments, suggestions, bug reports, # etc, to jr@terragate.net and logwatch-devel@logatch.org # ############################################################################### # What actual file? Defaults to LogPath if not absolute path.... LogFile = httpd/php_log LogFile = apache2/php_error_log.1 LogFile = apache2/php_error_log LogFile = apache2/php_error.log.1 LogFile = apache2/php_error.log # adjust your php.ini accordingly: # error_log = /var/log/httpd/php_log # log_errors = On # If the archives are searched, here is one or more line # (optionally containing wildcards) that tell where they are... #If you use a "-" in naming add that as well -mgt Archive = httpd/php_log.* Archive = httpd/php_log-* Archive = apache2/php_error_log.* Archive = apache2/php_error_log-* Archive = apache2/php_error.log.* Archive = apache2/php_error.log-* # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/logfiles/qmail-smtpd-current.conf0100644000000000000000000000105413040505236024231 0ustar rootroot########################################################################## # $Id$ ########################################################################## # $Log: qmail-smtpd-current.conf,v $ # Revision 1.1 2005/09/07 00:37:59 bjorn # New qmail multilog files written by Bob Hutchinson # ########################################################################## # What actual file? Defaults to LogPath if not absolute path.... LogFile = qmail/smtpd/@*.s LogFile = qmail/smtpd/current # Keep only the lines in the proper date range... *applytaidate usr/share/logwatch/default.conf/logfiles/exim.conf0100644000000000000000000000216713040505236021271 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 # Which logfile group... LogFile = exim/main.log LogFile = exim/mainlog LogFile = exim4/mainlog Archive = exim/main.log.* Archive = archiv/exim/main.log.* Archive = exim/mainlog.* Archive = exim4/mainlog.* Archive = exim/main.log-* Archive = archiv/exim/main.log-* Archive = exim/mainlog-* Archive = exim4/mainlog-* ######################################################## # This was written by: # Dariusz Nierada (dnierada@kat.supermedia.pl) # Please send all comments, suggestions, bug reports, # etc, to logwatch-devel@lists.sourceforge.net ######################################################## # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/logfiles/xferlog.conf0100644000000000000000000000146213040505236021772 0ustar rootroot########################################################################## # $Id$ ########################################################################## ######################################################## # This was written and is maintained by: # Kirk Bauer # # Please send all comments, suggestions, bug reports, # etc, to kirk@kaybee.org. ######################################################## # What actual file? Defaults to LogPath if not absolute path.... LogFile = xferlog # If the archives are searched, here is one or more line # (optionally containing wildcards) that tell where they are... #If you use a "-" in naming add that as well -mgt Archive = xferlog.* Archive = archiv/xferlog.* Archive = xferlog-* Archive = archiv/xferlog-* # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/logfiles/pix.conf0100644000000000000000000000067213040505236021126 0ustar rootroot########################################################################## # $Id$ ########################################################################## # $Log: pix.conf,v $ # Revision 1.1 2006/12/20 04:37:13 bjorn # Config files for new service for cisco pix files. # ########################################################################## LogFile = pix.log Archive = pix.log.* Archive = pix.log-* # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/logfiles/eventlog.conf0100644000000000000000000000263213040505236022147 0ustar rootroot########################################################################## # $Id$ ########################################################################## # $Log: eventlog.conf,v $ # Revision 1.2 2007/10/01 16:55:18 mike # Removed OnlyHost config in these files. It was not working correctly and has been added in the main script when it is needed. -mgt # # Revision 1.1 2007/04/28 22:50:24 bjorn # Added files for Windows Event Log, by Orion Poplawski. These are for # Windows events logged to a server, using Snare Agent or similar. # ########################################################################## # What actual file? Defaults to LogPath if not absolute path.... LogFile = eventlog # If the archives are searched, here is one or more line # (optionally containing wildcards) that tell where they are... # Note: if these are gzipped, you need to end with a .gz even if # you use wildcards... #If you use a "-" in naming add that as well -mgt Archive = eventlog.* Archive = eventlog.*.gz Archive = archiv/eventlog.* Archive = archiv/eventlog.*.gz Archive = eventlog-* Archive = eventlog-*.gz Archive = archiv/eventlog-* Archive = archiv/eventlog-*.gz # Expand the repeats (actually just removes them now) *ExpandRepeats # Now, lets remove the services we don't care about at all... #*RemoveService = talkd # Keep only the lines in the proper date range... *ApplyStdDate # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/logfiles/sonicwall.conf0100644000000000000000000000200413040505236022310 0ustar rootroot########################################################################## # $Id$ ########################################################################## ######################################################## # This was written and is maintained by: # Laurent DUFOUR , # based on the work of # Kirk Bauer # # Please send all comments, suggestions, bug reports, # etc, to logwatch-devel@lists.sourceforge.net ######################################################## # What actual file? Defaults to LogPath if not absolute path.... LogFile = sonicwall.log # If the archives are searched, here is one or more line # (optionally containing wildcards) that tell where they are... #If you use a "-" in naming add that as well -mgt Archive = sonicwall.log.* Archive = archiv/sonicwall.log.* Archive = sonicwall.log-* Archive = archiv/sonicwall.log-* # Keep only the lines in the proper date range... *ApplyStdDate # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/logfiles/http.conf0100644000000000000000000000244513040505236021305 0ustar rootroot######################################################## # Define log file group for httpd ######################################################## # What actual file? Defaults to LogPath if not absolute path.... LogFile = httpd/*access_log LogFile = apache/*access.log.1 LogFile = apache/*access.log LogFile = apache2/*access.log.1 LogFile = apache2/*access.log LogFile = apache2/*access_log LogFile = apache-ssl/*access.log.1 LogFile = apache-ssl/*access.log LogFile = nginx/*access.log LogFile = nginx/*access.log.1 # If the archives are searched, here is one or more line # (optionally containing wildcards) that tell where they are... #If you use a "-" in naming add that as well -mgt Archive = archiv/httpd/*access_log.* Archive = httpd/*access_log.* Archive = apache/*access.log.*.gz Archive = apache2/*access.log.*.gz Archive = apache2/*access_log.*.gz Archive = apache-ssl/*access.log.*.gz Archive = archiv/httpd/*access_log-* Archive = httpd/*access_log-* Archive = apache/*access.log-*.gz Archive = apache2/*access.log-*.gz Archive = apache2/*access_log-*.gz Archive = apache-ssl/*access.log-*.gz Archive = nginx/*access.log.*.gz # Expand the repeats (actually just removes them now) *ExpandRepeats # Keep only the lines in the proper date range... *ApplyhttpDate # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/logfiles/dpkg.conf0100644000000000000000000000146113040505236021250 0ustar rootroot########################################################################## # $Id$ ########################################################################## # $Log: dpkg.conf,v $ # Revision 1.1 2006/12/15 04:39:22 bjorn # New dpkg scripts, by Willi Mann. # ########################################################################## # Created by HMR 2/28/06 # Modified by Willi Mann # # What actual file? Defaults to LogPath if not absolute path.... LogFile = dpkg.log LogFile = dpkg.log.1 # If the archives are searched, here is one or more line # (optionally containing wildcards) that tell where they are... # Note: if these are gzipped, you need to end with a .gz even if # you use wildcards... Archive = dpkg.log.*.gz Archive = dpkg.log-*.gz *ApplyEuroDate # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/logfiles/iptables.conf0100644000000000000000000000146413040505236022131 0ustar rootroot########################################################################## # $Id$ ########################################################################## ######################################################## # This was written and is maintained by: # Kirk Bauer # # Please send all comments, suggestions, bug reports, # etc, to kirk@kaybee.org. ######################################################## # What actual file? Defaults to LogPath if not absolute path.... LogFile = ulogd/ulogd.syslogemu # If the archives are searched, here is one or more line # (optionally containing wildcards) that tell where they are... Archive = ulogd/ulogd.syslogemu.* Archive = ulogd/ulogd.syslogemu-* # Keep only the lines in the proper date range... *ApplyStdDate # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/logfiles/zypp.conf0100644000000000000000000000106213040505236021322 0ustar rootroot########################################################################## # $Id$ ########################################################################## # # What actual file? Defaults to LogPath if not absolute path.... LogFile = zypp/history # If the archives are searched, here is one or more line # (optionally containing wildcards) that tell where they are... # Note: if these are gzipped, you need to end with a .gz even if # you use wildcards... Archive = zypp/history.*.gz *ApplyEuroDate = "%Y-%m-%d %H:%M:%S" # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/logfiles/rt314.conf0100644000000000000000000000106413040505236021177 0ustar rootroot########################################################################## # $Id$ ########################################################################## # What actual file? Defaults to LogPath if not absolute path.... LogFile = netgear.log # If the archives are searched, here is one or more line # (optionally containing wildcards) that tell where they are... #If you use a "-" in naming add that as well -mgt Archive = netgear.log.* Archive = netgear.log-* # Keep only the lines in the proper date range... *ApplyStdDate # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/logfiles/vsftpd.conf0100644000000000000000000000152213040505236021627 0ustar rootroot########################################################################## # $Id$ ########################################################################## ######################################################## # This was written and is maintained by: # Kirk Bauer # # Please send all comments, suggestions, bug reports, # etc, to kirk@kaybee.org. # ######################################################## # What actual file? Defaults to LogPath if not absolute path.... LogFile = vsftpd.log # If the archives are searched, here is one or more line # (optionally containing wildcards) that tell where they are... #If you use a "-" in naming add that as well -mgt Archive = vsftpd.log.* Archive = archiv/vsftpd.log.* Archive = vsftpd.log-* Archive = archiv/vsftpd.log-* *ApplyStdDate = # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/logfiles/kernel.conf0100644000000000000000000000166013040505236021604 0ustar rootroot########################################################################### # $Id$ ########################################################################### # $Log: kernel.conf,v $ # Revision 1.2 2007/10/01 16:55:18 mike # Removed OnlyHost config in these files. It was not working correctly and has been added in the main script when it is needed. -mgt # # Revision 1.1 2006/03/21 03:01:34 bjorn # Debian-specific log files, by Willi Mann. # ########################################################################### # kernel log file for debian-based systems LogFile = kern.log LogFile = kern.log.0 Archive = kern.log.*.gz Archive = kern.log-*.gz *ExpandRepeats *ApplyStdDate ########################################################################### # Please send all comments, suggestions, bug reports, # etc, to logwatch-devel@lists.sourceforge.net ########################################################################### usr/share/logwatch/default.conf/logfiles/fail2ban.conf0100644000000000000000000000162213040505236022000 0ustar rootroot########################################################################### # $Id$ ########################################################################### # $Log: fail2ban.conf,v $ # Revision 1.2 2006/12/15 04:53:39 bjorn # Now using ApplyEuroDate, by Willi Mann. # # Revision 1.1 2006/05/30 19:04:26 bjorn # Added fail2ban service, written by Yaroslav Halchenko. # ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 *ApplyEuroDate LogFile = fail2ban.log Archive = fail2ban.log.1 Archive = fail2ban.log.*.gz Archive = fail2ban.log-* usr/share/logwatch/default.conf/logfiles/qmail-pop3ds-current.conf0100644000000000000000000000105713040505236024315 0ustar rootroot########################################################################## # $Id$ ########################################################################## # $Log: qmail-pop3ds-current.conf,v $ # Revision 1.1 2005/09/07 00:37:59 bjorn # New qmail multilog files written by Bob Hutchinson # ########################################################################## # What actual file? Defaults to LogPath if not absolute path.... LogFile = qmail/pop3ds/@*.s LogFile = qmail/pop3ds/current # Keep only the lines in the proper date range... *applytaidate usr/share/logwatch/default.conf/logfiles/dnssec.conf0100644000000000000000000000533613040505236021607 0ustar rootroot############################################################################# # $Id$ ############################################################################# # $Log: dnssec.conf,v $ # Revision 1.1 2005/10/19 05:57:40 bjorn # dnssec and resolver scripts, written by Lindy Foster # ############################################################################# #Copyright (c) 2004, Sparta, Inc #All rights reserved. # #Redistribution and use in source and binary forms, with or without #modification, are permitted provided that the following conditions are met: # #* Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # #* Redistributions in binary form must reproduce the above copyright # notice, this list of conditions and the following disclaimer in the # documentation and/or other materials provided with the distribution. # #* Neither the name of Sparta, Inc nor the names of its contributors may # be used to endorse or promote products derived from this software # without specific prior written permission. # #THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS ``AS #IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, #THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR #PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDERS OR #CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, #EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, #PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; #OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, #WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR #OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF #ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ############################################################################# ############################################################################# # These scripts were created as part of the dnssec-tools project. # For more information, see http://sourceforge.net/dnssec-tools. # Detailed instructions for setting up BIND 9.3.* to use these logwatch # configuration files and scripts are containted in the README file # on sourceforge. ############################################################################# ######################################################## # Define log file group for DNSSEC ######################################################## # What actual file? Defaults to LogPath if not absolute path.... LogFile = dnssec # Expand the repeats (actually just removes them now) *ExpandRepeats # Keep only the lines in the proper date range... *ApplyBindDate usr/share/logwatch/default.conf/logfiles/http-error.conf0100644000000000000000000000244513040505236022434 0ustar rootroot######################################################## # Define log file group for httpd ######################################################## # What actual file? Defaults to LogPath if not absolute path.... LogFile = httpd/*error_log LogFile = apache/*error.log.1 LogFile = apache/*error.log LogFile = apache2/*error.log.1 LogFile = apache2/*error.log LogFile = apache2/*error_log LogFile = apache-ssl/*error.log.1 LogFile = apache-ssl/*error.log # If the archives are searched, here is one or more line # (optionally containing wildcards) that tell where they are... #If you use a "-" in naming add that as well -mgt Archive = archiv/httpd/*error_log.* Archive = httpd/*error_log.* Archive = apache/*error.log.*.gz Archive = apache2/*error.log.*.gz Archive = apache2/*error_log.*.gz Archive = apache-ssl/*error.log.*.gz Archive = varnish/*error.log.*.gz Archive = archiv/httpd/*error_log-* Archive = httpd/*error_log-* Archive = apache/*error.log-*.gz Archive = apache2/*error.log-*.gz Archive = apache2/*error_log-*.gz Archive = apache-ssl/*error.log-*.gz # Expand the repeats (actually just removes them now) *ExpandRepeats # Keep only the lines in the proper date range... *ApplyhttpDate # or use a custom time filter: # *ApplyStdDate = "\[%a %b %d %H:%M:%S %Y\]" # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/logfiles/syslog.conf0100644000000000000000000000223413040505236021642 0ustar rootroot########################################################################### # $Id$ ########################################################################### # $Log: syslog.conf,v $ # Revision 1.3 2009/06/12 14:16:06 mike # Change to comma separated list for RemoveService lines in syslog and message conf -mgt # # Revision 1.2 2007/10/01 16:55:18 mike # Removed OnlyHost config in these files. It was not working correctly and has been added in the main script when it is needed. -mgt # # Revision 1.1 2006/03/21 03:01:34 bjorn # Debian-specific log files, by Willi Mann. # ########################################################################### # Syslog file for debian-based systems Logfile = Archive = LogFile = syslog LogFile = syslog.0 Archive = syslog.*.gz Archive = syslog-*.gz *ExpandRepeats #Comma separated list works best -mgt *RemoveService = talkd,telnetd,inetd,nfsd,/sbin/mingetty *ApplyStdDate ########################################################################### # Please send all comments, suggestions, bug reports, # etc, to logwatch-devel@lists.sourceforge.net ########################################################################### usr/share/logwatch/default.conf/logfiles/secure.conf0100644000000000000000000000210613040505236021606 0ustar rootroot########################################################################## # $Id$ ########################################################################## ######################################################## # This was written and is maintained by: # Kirk Bauer # # Please send all comments, suggestions, bug reports, # etc, to kirk@kaybee.org. ######################################################## # What actual file? Defaults to LogPath if not absolute path.... LogFile = secure LogFile = authlog LogFile = auth.log LogFile = auth.log.0 # If the archives are searched, here is one or more line # (optionally containing wildcards) that tell where they are... #If you use a "-" in naming add that as well -mgt Archive = secure.* Archive = archiv/secure.* Archive = authlog.* Archive = auth.log.*.gz Archive = secure-* Archive = archiv/secure-* Archive = authlog-* Archive = auth.log-*.gz # Expand the repeats (actually just removes them now) *ExpandRepeats # Keep only the lines in the proper date range... *ApplyStdDate # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/logfiles/samba.conf0100644000000000000000000000120513040505236021402 0ustar rootroot########################################################################## # $Id$ ########################################################################## ######################################################## # This was written and is maintained by: # Kirk Bauer # # Please send all comments, suggestions, bug reports, # etc, to kirk@kaybee.org. ######################################################## # What actual file? Defaults to LogPath if not absolute path.... LogFile = samba-log.* LogFile = samba/*.log LogFile = samba/log.* #Negate hostlimit command NoHostFilter = Yes # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/logfiles/clamav.conf0100644000000000000000000000151013040505236021561 0ustar rootroot######################################################################### # Files - all shown with default paths: # # /usr/share/logwatch/default.conf/logfiles/clamav.conf (this file) # /usr/share/logwatch/default.conf/services/clamav.conf # /usr/share/logwatch/scripts/services/clamav # # ... and of course # # /var/log/clamd.log ######################################################################### # What actual file? Defaults to LogPath if not absolute path.... LogFile = clamd LogFile = clamav LogFile = clamd.log LogFile = clamav.log # If the archives are searched, here is one or more line # (optionally containing wildcards) that tell where they are... Archive = clamd.* Archive = clamav.* Archive = clamav/clamd.* Archive = clamav/clamav.* Archive = archiv/clamd.* Archive = archiv/clamav.* # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/logfiles/clam-update.conf0100644000000000000000000000445013040505236022520 0ustar rootroot######################################################################### # clam-update script for Logwatch # Analyzes the Clam Anti-Virus update log # # Version: 1.0.0 # Initial release # Version: 1.0.1 # Minor documentation update # # Written by: Lars Skjrlund ######################################################################### ######################################################################### # This script is subject to the same copyright as Logwatch itself ######################################################################### ######################################################################### # Files - all shown with default paths: # # /usr/share/logwatch/default.conf/logfiles/clam-update.conf (this file) # /usr/share/logwatch/default.conf/services/clam-update.conf # /usr/share/logwatch/scripts/services/clam-update # # ... and of course # # /var/log/clam-update ######################################################################### ######################################################################### # Important note: # # Under normal operation - ie. a detail level of 'lo' (0), no output will # be produced if no updates have taken place. However, if no update # attempt has been done, an alert will be output to inform you about this # (which probably means that freshclam isn't running). # # If you have stopped using ClamAV and would like to get rid of the # alert, you should delete the logfile. If there's no logfile, no alerts # will be output - but if Logwatch finds a logfile and no update attempts # have been made for whatever timeperiod Logwatch is analyzing, an alert # will be output. ######################################################################### # What actual file? Defaults to LogPath if not absolute path.... LogFile = clam-update LogFile = freshclam.log LogFile = clamav/freshclam.log # If the archives are searched, here is one or more line # (optionally containing wildcards) that tell where they are... Archive = clam-update.* Archive = freshclam.log.* Archive = clamav/freshclam.log.* Archive = archiv/clam-update.* Archive = archiv/freshclam.log.* Archive = clam-update-* Archive = freshclam.log-* Archive = clamav/freshclam.log-* Archive = archiv/clam-update-* Archive = archiv/freshclam.log-* # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/logfiles/dirsrv.conf0100644000000000000000000000035013040505236021630 0ustar rootroot# What actual file? Defaults to LogPath if not absolute path.... LogFile = dirsrv/*/errors Archive = dirsrv/*/errors.[1-9]* *ApplyStdDate = "\[%d/%b/%Y:%H:%M:%S" *RemoveHeaders = "\[[^]]+\] (- )?" # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/logfiles/cron.conf0100644000000000000000000000150113040505236021257 0ustar rootroot########################################################################## # $Id$ ########################################################################## ######################################################## # This was written and is maintained by: # Kirk Bauer # # Please send all comments, suggestions, bug reports, # etc, to kirk@kaybee.org. ######################################################## # What actual file? Defaults to LogPath if not absolute path.... #Solaris is /var/cron/log -mgt LogFile = /var/cron/log LogFile = cron # If the archives are searched, here is one or more line # (optionally containing wildcards) that tell where they are... Archive = cron.* Archive = archiv/cron.* Archive = cron-* Archive = archiv/cron-* *RemoveService = anacron # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/logfiles/tivoli-smc.conf0100644000000000000000000000150113040505236022404 0ustar rootroot########################################################################## # $Id$ ########################################################################## # # What actual file? Defaults to LogPath if not absolute path.... LogFile = tsm_error.log LogFile = dsmerror.log # If the archives are searched, here is one or more line # (optionally containing wildcards) that tell where they are... # Note: if these are gzipped, you need to end with a .gz even if # you use wildcards... Archive = tsm_error.log-*.gz Archive = dsmerror.log-*.gz ## This depends on the DATEFormat configuration in dsm.opt. ## With default config: *ApplyStdDate = "%m/%d/%Y %H:%M:%S" *RemoveHeaders = "..\/..\/.... ..:..:.. " ## With "DATEFormat 3": #*ApplyEuroDate #*RemoveHeaders = "\d{4}-\d\d-\d\d \d\d:\d\d:\d\d " # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/logfiles/citadel.conf0100644000000000000000000000142413040505236021727 0ustar rootroot########################################################################## # $Id$ ########################################################################## ######################################################## # This was written and is maintained by: # Stefan Jakobs # # Please send all comments, suggestions, bug reports, # etc, to . ######################################################## # What actual file? Defaults to LogPath if not absolute path.... LogFile = citadel.log # If the archives are searched, here is one or more line # (optionally containing wildcards) that tell where they are... Archive = citadel.log.* # Keep only the lines in the proper date range... *ApplyStdDate # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/logfiles/spamassassin.conf0100644000000000000000000000233013040505236023024 0ustar rootroot######################################################################## #spamassassin script for Logwatch # # Version: 1.0.0 # Initial release ######################################################################### ######################################################################### # This script is subject to the same copyright as Logwatch itself ######################################################################### ######################################################################### # Files - all shown with default paths: # # /usr/share/logwatch/default.conf/logfiles/spamassassin.conf (this file) # /usr/share/logwatch/default.conf/services/spamassassin.conf # /usr/share/logwatch/scripts/services/spamassassin # # ... and of course # # /var/log/spamassassin ######################################################################### # What actual file? Defaults to LogPath if not absolute path.... LogFile = spamd/spamd.log # If the archives are searched, here is one or more line # (optionally containing wildcards) that tell where they are... Archive = spamd/spamd.log[.-]* Archive = spamd/spamd.log[.-]*.gz # Keep only the lines in the proper date range... *ApplyStdDate # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/logfiles/pureftp.conf0100644000000000000000000000153513040505236022012 0ustar rootroot########################################################################## # $Id$ ########################################################################## ######################################################## # This was written and is maintained by: # Kirk Bauer # # Please send all comments, suggestions, bug reports, # etc, to kirk@kaybee.org. ######################################################## # What actual file? Defaults to LogPath if not absolute path.... LogFile = pureftp/syslog.log # If the archives are searched, here is one or more line # (optionally containing wildcards) that tell where they are... #If you use a "-" in naming add that as well -mgt Archive = pureftp/syslog.log.* Archive = pureftp/syslog.log-* # Keep only the lines in the proper date range... *ApplyStdDate # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/logfiles/mysql-mmm.conf0100644000000000000000000000125613040505236022256 0ustar rootroot########################################################################## # $Id$ ########################################################################## # What actual file? Defaults to LogPath if not absolute path.... LogFile = mysql-mmm/mmm_agentd.log LogFile = mysql-mmm/mmm_agentd.log.1 LogFile = mysql-mmm/mmm_mond.log LogFile = mysql-mmm/mmm_mond.log.1 # If the archives are searched, here is one or more line # (optionally containing wildcards) that tell where they are... Archive = mysql-mmm/mmm_agentd.log.*.gz Archive = mysql-mmm/mmm_mond.log.*.gz # Keep only the lines in the proper date range... *ApplyStdDate = "%Y/%m/%d %H:%M:%S" # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/ignore.conf0100644000000000000000000000171113040505236020000 0ustar rootroot######################################################## # This was written and is maintained by: # Kirk Bauer # # Please send all comments, suggestions, bug reports, # etc, to logwatch-devel@lists.sourceforge.net. # ######################################################## ####################################################### #Ignore entries for logwatch. ###################################################### #This file is used to filter out any lines that you # do not want to see in your reports. # #Simply cut and paste as much of the line as needed # below be warned that it is possible to really # limit your reports by placing a bad value below. # #BAD EXMAPLE: putting a single "." alone on a line will # filter all output ###################################################### #STARTTLS=server: file /etc/mail/certs/cert.pem unsafe #pam_succeed_if: requirement "uid < 100" not met # vi: shiftwidth=3 tabstop=3 syntax=perl et usr/share/logwatch/default.conf/html/0040755000000000000000000000000013040505236016615 5ustar rootrootusr/share/logwatch/default.conf/html/footer.html0100644000000000000000000000223413040505236020777 0ustar rootroot

Logwatch ©Copyright 2002-2006 Kirk Bauer

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

usr/share/logwatch/default.conf/html/header.html0100644000000000000000000000217513040505236020735 0ustar rootroot Logwatch $Version ( $VDate )
usr/share/logwatch/default.conf/services/0040755000000000000000000000000013040505236017474 5ustar rootrootusr/share/logwatch/default.conf/services/ftpd-messages.conf0100644000000000000000000000176013040505236023106 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "ftpd-messages" # Which logfile group... LogFile = messages *OnlyService = ftpd *RemoveHeaders # Set this to 1 if you want to ignore unmatched FTP messages... $ftpd_ignore_unmatched = 0 ######################################################## # This was written and is maintained by: # Kirk Bauer # # Please send all comments, suggestions, bug reports, # etc, to kirk@kaybee.org. ######################################################## # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/qmail-pop3ds.conf0100644000000000000000000000341113040505236022650 0ustar rootroot########################################################################### # $Id$ ########################################################################### # $Log: qmail-pop3ds.conf,v $ # Revision 1.1 2005/09/07 00:37:59 bjorn # New qmail multilog files written by Bob Hutchinson # ########################################################################### # for use with multilog # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "qmail-pop3s" # Which logfile group... LogFile = qmail-pop3ds-current # Only give lines pertaining to the qmail service... #*OnlyService = qmail *RemoveHeaders = # This sets whether to display counts of emails from each user & to each user. # Will make rather a large log file if run on a primary mail server. # Set either 0 or 1 $qmail_high_detail = 1 # Threshold controls the minimum number for: # "From this server" ($from_threshold) # "To Remote Server" ($remote_threshold) # "To Local Server" ($local_threshold) # Threshold is a global variable. # These are only used IF you have $qmail_high_detail set to 1 $threshold = 10 # From threshold is a minimum for the number of emails people send out. # This will over-ride threshold for this value. # If it is not set, the global $threshold is used. Set to 0 for all. $from_threshold = # Remote threshold is a minimum for the number of emails that go to a remote server. # This will over-ride threshold for this value. # If it is not set, the global $threshold is used. Set to 0 for all. $to_threshold = usr/share/logwatch/default.conf/services/pound.conf0100644000000000000000000000211313040505236021462 0ustar rootroot########################################################################### # pound.conf ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "pound" # Which logfile group... LogFile = messages # Whether or not to lookup the IPs into hostnames... # Setting this to Yes will significantly increase runtime $pound_ip_lookup = Yes # Only give lines pertaining to the named service... *OnlyService = pound *RemoveHeaders = ######################################################## # This was written and is maintained by: # luuk # # Please send all comments, suggestions, bug reports, # etc, to luuk@planet.nl. # ######################################################## # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/mailscanner.conf0100644000000000000000000000175613040505236022645 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "MailScanner" # Which logfile group... LogFile = maillog # Only give lines pertaining to the sendmail service... *OnlyService = MailScanner *RemoveHeaders #Mailscanner Global ENV Variables $mailscanner_phishing_detail = 0 $mailscanner_phishingthreshold = 1 ######################################################## # This was written and is maintained by: # Mike Tremaine # ######################################################## # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/knockd.conf0100644000000000000000000000166013040505236021614 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "Knockd" # Which logfile group... LogFile = syslog # Only give lines pertaining to the knockd service... *OnlyService = knockd *RemoveHeaders ########################################################################### # Please send all comments, suggestions, bug reports, # etc, to logwatch-devel@lists.sourceforge.net ########################################################################### # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/modprobe.conf0100644000000000000000000000171313040505236022151 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "ModProbe" # Which logfile group... LogFile = messages # Only give lines pertaining to the modprobe service... *OnlyService = modprobe *RemoveHeaders ######################################################## # This was written and is maintained by: # Kirk Bauer # # Please send all comments, suggestions, bug reports, # etc, to kirk@kaybee.org. ######################################################## # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/cisco.conf0100644000000000000000000000154613040505236021446 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "cisco" # Which logfile group... LogFile = cisco ######################################################## # This was written and is maintained by: # Kirk Bauer # # Please send all comments, suggestions, bug reports, # etc, to kirk@kaybee.org. ######################################################## # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/resolver.conf0100644000000000000000000000516413040505236022207 0ustar rootroot############################################################################# # $Id$ ############################################################################# # $Log: resolver.conf,v $ # Revision 1.1 2005/10/19 05:57:40 bjorn # dnssec and resolver scripts, written by Lindy Foster # ############################################################################# #Copyright (c) 2004, Sparta, Inc #All rights reserved. # #Redistribution and use in source and binary forms, with or without #modification, are permitted provided that the following conditions are met: # #* Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # #* Redistributions in binary form must reproduce the above copyright # notice, this list of conditions and the following disclaimer in the # documentation and/or other materials provided with the distribution. # #* Neither the name of Sparta, Inc nor the names of its contributors may # be used to endorse or promote products derived from this software # without specific prior written permission. # #THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS ``AS #IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, #THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR #PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDERS OR #CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, #EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, #PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; #OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, #WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR #OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF #ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ############################################################################# ############################################################################# # These scripts were created as part of the dnssec-tools project. # For more information, see http://sourceforge.net/dnssec-tools. # Detailed instructions for setting up BIND 9.3.* to use these logwatch # configuration files and scripts are containted in the README file # on sourceforge. ############################################################################# ########################################################################### # Configuration file for resolver filter ########################################################################### Title = "Resolver" # Which logfile group... LogFile = resolver usr/share/logwatch/default.conf/services/imapd.conf0100644000000000000000000000161013040505236021430 0ustar rootroot########################################################################### # ------------------------------------------------------------------------ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "IMAP" # Which logfile group... LogFile = maillog # Only give lines pertaining to courier... # I'm not sure if this is complete, especially for the new webmail daemon in 0.44.1 #but you will get at least all currently supported logs *OnlyService = (imapd|imapd-ssl|imapsd) *RemoveHeaders = # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/zz-network.conf0100644000000000000000000000226613040505236022500 0ustar rootroot########################################################################### # $Id$ ########################################################################### # This just displays a fortune at the end of the report... # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "Network Report" # Which logfile group... LogFile = NONE # The following variables may be set. They are commented-out because these # are the same defaults in the zz-network script # $pathto_chkconfig=/sbin/chkconfig # $pathto_vtysh=/usr/bin/vtysh # $pathto_sysctl_conf=/etc/sysctl.conf # $pathto_routeadm=/usr/sbin/routeadm # $pathto_ip=/sbin/ip # $pathto_ifconfig=/sbin/ifconfig ######################################################## # Please send all comments, suggestions, bug reports, # etc, to logwatch-devel@lists.sourceforge.net ######################################################## # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/denyhosts.conf0100644000000000000000000000065413040505236022365 0ustar rootroot############################################################################### # $Id$ ############################################################################### # $Log: denyhosts.conf,v $ # Revision 1.1 2006/11/12 18:32:54 bjorn # New service denyhosts, by grubert. # ############################################################################### Title = "Denyhosts" LogFile = denyhosts # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/pureftpd.conf0100644000000000000000000000170613040505236022175 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "pureftp" # Which logfile group... LogFile = pureftp *OnlyService = pure-ftpd *RemoveHeaders = # Should we show some details? $show_logins = 0 $show_logouts = 0 # This can get rather large, it details files which were uploaded or downloaded # by who, and where from. $show_data_transfers = 0 # How many connections did we get? # This only shows where it came from and how many per ip / host. $show_new_connections = 0 # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/rsyslogd.conf0100644000000000000000000000047013040505236022207 0ustar rootroot########################################################################### # Configuration file for rsyslogd filter ########################################################################### Title = "rsyslogd" LogFile = LogFile = syslog *OnlyService = rsyslogd *RemoveHeaders # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/identd.conf0100644000000000000000000000167113040505236021614 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "identd" # Which logfile group... LogFile = messages # Only give lines pertaining to identd... *OnlyService = identd *RemoveHeaders ######################################################## # This was written and is maintained by: # Kirk Bauer # # Please send all comments, suggestions, bug reports, # etc, to kirk@kaybee.org. ######################################################## # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/saslauthd.conf0100644000000000000000000000163613040505236022336 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = SASL Auth Daemon # Which logfile group... LogFile = secure # Only give lines pertaining to the postfix service... *OnlyService = "saslauthd\[\d+\]" *RemoveHeaders = ######################################################## # This was written and is maintained by: # # Please send all comments, suggestions, bug reports, # ######################################################## # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/arpwatch.conf0100644000000000000000000000126513040505236022155 0ustar rootroot########################################################################## # $Id$ ########################################################################## # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "Arpwatch" # Which logfile group... LogFile = messages # Only give lines pertaining to the arpwatch service... *OnlyService = arpwatch *RemoveHeaders # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/zz-disk_space.conf0100644000000000000000000000342513040505236023112 0ustar rootroot# This just displays the file system disk usage at the end of the report... # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "Disk Space" # Which logfile group... LogFile = NONE # disk report options # Uncomment this to show the home directory sizes #$show_home_dir_sizes = 1 #$home_dir = "/home" # Uncomment this to show the mail spool size #$show_mail_dir_sizes = 1 #$mail_dir = "/var/spool/mail" # Uncomment this to show the system directory sizes /opt /usr/ /var/log #$show_disk_usage = 1 # The variables df_options and disk_cmd are used to customize the reporting # of filesystem disk usage. For example, the following are the defaults # for Linux OS: # $df_options = "-h -l -x tmpfs" # $disk_cmd = "df $df_options" # Uncomment this to add -l to df command. Only see local disks. #$local_disks_only = 1 # The variable diskfull_threshold, when set to a positive number, will # print a warning if the disk utilization exceeds that number. Default # is 90. Set to 0 if no warning desired. #$diskfull_threshold = 0 # Regular expression to exclude directories from disk full warnings. # Expression is achored at the beginning with ^, but not at the end. #$diskfull_exclude_dirs = /run/media ######################################################## # This was written and is maintained by: # Kirk Bauer # # Please send all comments, suggestions, bug reports, # etc, to kirk@kaybee.org. ######################################################## # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/emerge.conf0100644000000000000000000000120513040505236021602 0ustar rootroot########################################################################## # $Id$ ########################################################################## ############################################################# # This was written and is maintained by: # Laurent DUFOUR , # based on the work of # Kirk Bauer # # Please send all comments, suggestions, bug reports, # etc, to laurent.dufour at havas.com ############################################################## Title = "emerge" # Which logfile group... LogFile = emerge # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/omsa.conf0100644000000000000000000000104013040505236021272 0ustar rootroot# You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "Dell OMSA" # Which logfile group... LogFile = messages # Only give lines pertaining to the OMSA service... *OnlyService = Server_Administrator *RemoveHeaders # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/tac_acc.conf0100644000000000000000000000107113040505236021714 0ustar rootroot######################################################## # $Id$ ######################################################## # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "Tacacs accounting" # Which logfile group... LogFile = tac_acc # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/evtsystem.conf0100644000000000000000000000173713040505236022413 0ustar rootroot########################################################################## # $Id$ ########################################################################## # $Log: evtsystem.conf,v $ # Revision 1.1 2007/04/28 22:50:24 bjorn # Added files for Windows Event Log, by Orion Poplawski. These are for # Windows events logged to a server, using Snare Agent or similar. # ########################################################################## # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "System Event Log" # Which logfile group... LogFile = eventlog # Only give lines pertaining to the kernel service... *EventLogOnlyService = system *RemoveHeaders # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/init.conf0100644000000000000000000000167713040505236021316 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "Init" # Which logfile group... LogFile = messages # Only give lines pertaining to the init service... *OnlyService = init *RemoveHeaders ######################################################## # This was written and is maintained by: # Kirk Bauer # # Please send all comments, suggestions, bug reports, # etc, to kirk@kaybee.org. ######################################################## # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/raid.conf0100644000000000000000000000025213040505236021256 0ustar rootroot Title = "Raid" # Which logfile group... LogFile = messages # Only give lines pertaining to the kernel service... *OnlyService = kernel # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/slon.conf0100644000000000000000000000236413040505236021320 0ustar rootroot########################################################################### # $Id$ ########################################################################### # $Log: slon.conf,v $ # Revision 1.2 2005/10/31 16:21:20 bjorn # Updates to paths to reflect new Filesystem Hierarchy Standard, # by Ivana Varekova. # # Revision 1.1 2005/09/27 21:51:25 bjorn # New slon service by Jeff Frost # ########################################################################### # This config file assumes that slon is # logging to /var/log/messages, if not, you need to # update the /usr/share/logwatch/default.conf/services/slon.conf and # possibly add a new entry in /usr/share/logwatch/default.conf/logfiles # ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "slon" # Which logfile group... LogFile = messages # Only give lines pertaining to the sshd service... *OnlyService = slon *RemoveHeaders usr/share/logwatch/default.conf/services/netopia.conf0100644000000000000000000000163313040505236022002 0ustar rootroot########################################################################### # $id: netopia.conf,v 1.1 2004/09/28 01:50:15 mgt Exp $ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "netopia" # Which logfile group... LogFile = netopia ######################################################## # This was written and is maintained by: # Kirk Bauer # # Please send all comments, suggestions, bug reports, # etc, to kirk@kaybee.org. ######################################################## # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/postgresql.conf0100644000000000000000000000156613040505236022553 0ustar rootroot# Service definition for PostgreSQL error log # You can put comments anywhere you want to. They are effective for the # rest of the line. # # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # # Yes = True = On = 1 # No = False = Off = 0 Title = "PostgreSQL" # Which logfile group... LogFile = postgresql # Set it to High to also report HINT and WARNING log lines. # By default it will report PANIC, FATAL and ERROR lines. #Detail = High ########################################################################### ## Please send all comments, suggestions, bug reports, ## etc, to logwatch-devel@lists.sourceforge.net ############################################################################ # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/up2date.conf0100644000000000000000000000156113040505236021707 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "up2date" # Which logfile group... LogFile = up2date ######################################################## # This was written and is maintained by: # Eric Moret # # Please send all comments, suggestions, bug reports, # etc, to eric.moret@epita.fr. ######################################################## # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/autorpm.conf0100644000000000000000000000155113040505236022031 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "AutoRPM" # Which logfile group... LogFile = autorpm ######################################################## # This was written and is maintained by: # Kirk Bauer # # Please send all comments, suggestions, bug reports, # etc, to kirk@kaybee.org. ######################################################## # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/puppet.conf0100644000000000000000000000165113040505236021660 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "Puppet" # Which logfile group... LogFile = syslog LogFile = messages *OnlyService = puppet(d|-agent) *RemoveHeaders ######################################################## # This was written and is maintained by: # Kirk Bauer # # Please send all comments, suggestions, bug reports, # etc, to kirk@kaybee.org. ######################################################## # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/zz-fortune.conf0100644000000000000000000000164213040505236022466 0ustar rootroot########################################################################### # $Id$ ########################################################################### # This just displays a fortune at the end of the report... # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "Fortune" # Which logfile group... LogFile = NONE ######################################################## # This was written and is maintained by: # Kirk Bauer # # Please send all comments, suggestions, bug reports, # etc, to kirk@kaybee.org. ######################################################## # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/zz-runtime.conf0100644000000000000000000000125413040505236022466 0ustar rootroot########################################################################### # $Id$ ########################################################################### # $Log: zz-runtime.conf,v $ # Revision 1.2 2007/04/28 23:47:13 bjorn # Added show_runtime variable. # # Revision 1.1 2007/03/17 19:28:42 bjorn # Added zz-runtime for runtime statistics. Currently prints uptime, # per Jason Sjobeck's proposal. # ########################################################################### Title = "Runtime Statistics" LogFile = NONE # The variable show_uptime, when set to one, will display the # uptime at the time the script is run. #$show_uptime = 0 # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/sendmail-largeboxes.conf0100644000000000000000000000243713040505236024273 0ustar rootroot########################################################################### # $Id$ ########################################################################### # This displays a warning for large mailboxes # Best solution would be to have a config setting for what the # server administrator considers as "large". Hard coded to consider 40Mb+ # as large. # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 # service title Title = "sendmail-largeboxes (large mail spool files)" # Which logfile group... LogFile = NONE # Mailbox size threshold # can add units KB, MB, GB, TB # can set to 0 to report spool files being created where they shouldn't $sendmail_largeboxes_size = 40MB ######################################################## # This was written and is maintained by: # Colin Smith # # Please send all comments, suggestions, bug reports, # etc, to Colin.Smith@fantasie.org.uk ######################################################## # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/windows.conf0100644000000000000000000000221313040505236022030 0ustar rootroot########################################################################## # $Id$ ########################################################################## ########################################################################## # This was written and is maintained by: # William Roumier # # Please send all comments, suggestions, bug reports, # etc, to logwatch-devel@lists.sourceforge.net ########################################################################## # This service analyzes the syslog entries for Windows # systems. It requires an utility to extract information # from the Windows eventlog, and forward it to a UNIX syslog # server. ########################################################################## # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "windows" # Which logfile group... LogFile = windows usr/share/logwatch/default.conf/services/dovecot.conf0100644000000000000000000000203113040505236021777 0ustar rootroot# You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "Dovecot" # Which logfile group... LogFile = maillog *OnlyService = (imap-login|pop3-login|dovecot) *RemoveHeaders = "^\w{3} .\d \d\d:\d\d:\d\d (?:[^\s:]* )?" # Override the default Detail level. This will only affect dovecot's report. #$dovecot_detail = 10 # Variable $dovecot_ignore_host is used to filter out hosts that login # successfully. This commented-out example filters out reserved local # addresses (IETF RFC 1918 and RFC 3330). #$dovecot_ignore_host="^\[10\.|^172\.(1[6-9]|2[0-9]|3[01])\.|^192\.168\.|^127\.\d\.\d\.\d\]$" # Boolean option $dovecot_numeric is used to disable DNS lookups. # DNS lookups are enabled by default #$dovecot_numeric = 0 # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/yum.conf0100644000000000000000000000012713040505236021152 0ustar rootrootTitle = "yum" # Which logfile group... LogFile = yum # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/afpd.conf0100644000000000000000000000125313040505236021253 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "afpd" # Which logfile group... LogFile = messages # Only give lines pertaining to the afpd service... *OnlyService = afpd *RemoveHeaders # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/freeradius.conf0100644000000000000000000000123213040505236022467 0ustar rootroot########################################################################## # $Id$ ########################################################################## # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "FreeRADIUS" # Which logfile group... LogFile = freeradius #Detail=med *OnlyService = (radiusd|freeradius) *RemoveHeaders # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/mysql.conf0100644000000000000000000000023213040505236021502 0ustar rootroot# # Service definition for MySQL error log # Title = mysqld # Which logfile group... LogFile = mysql # Detail = High # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/oidentd.conf0100644000000000000000000000126613040505236021773 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "Oidentd" # Which logfile group... LogFile = messages # Only give lines pertaining to the modprobe service... *OnlyService = oidentd *RemoveHeaders # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/bfd.conf0100644000000000000000000000070413040505236021074 0ustar rootroot########################################################################## # $Id$ ########################################################################## # $Log: bfd.conf,v $ # Revision 1.1 2007/04/15 19:48:23 bjorn # New bfd (Brute Force Detection) service, by Andy Bolstridge. # ########################################################################## Title = "BFD" # Which logfile group... LogFile = bfd #*RemoveHeaders = *ApplyStdDate = usr/share/logwatch/default.conf/services/postfix.conf0100644000000000000000000003052713040505236022043 0ustar rootroot# # postfix.conf / postfix-logwatch.conf # # This is the postfix-logwatch configuration file. # Lines in this file are of the format: # # VAR = VALUE # *VAR = VALUE # $VAR = VALUE # # Whitespace surrounding the = assignment character is removed. Variable names # and values are case insensitive. Double quotes can be used to preserve case and # whitespace. # # Variables beginning with a * are used only by logwatch. # Variables beginning with a $ are used only by the postfix-logwatch filter. # Variables beginning with neither * nor $ are used only by logwatch, with the # exception of the Detail variable which is passed via environment to the # postfix-logwatch filter. # # Any of the equivalent boolean values below may be used where appropriate: # # 1, Yes, True, On # 0, No, False, Off # # Lines that begin with a # are comment lines. Blank and whitespace lines # are ignored. Whitespace at the beginning and end of a line is ignored. # # Specifies the title used in the logwatch report # Title = "Postfix" # Specifies the logwatch logfile group # LogFile = maillog # Specifies the global, maximum detail level # #Detail = 10 # The *OnlyService selector is used solely by logwatch to select log lines # to pass to the postfix-logwatch filter. And postfix-logwatch uses the # $postfix_Syslog_Name variable for log line selection. # # When used in logwatch, both the *OnlyService and $postfix_Syslog_Name # variables below should contain essentially the same REs so that lines passed # by logwatch are also selected by postfix-logwatch. Note that *OnlyService # also includes the / (eg. postfix/smtpd). # # If you change postfix's syslog_name for any postfix service, you will need to # replace "postfix" below with an appropriate RE to capture the desired log entries. # Do likewise for *OnlyService above when used under logwatch. For example, the # settings: # # *OnlyService = "postfix\d?/[-a-zA-Z\d]*" # $postfix_Syslog_Name = "postfix\d?" # # will capture postfix/smtpd, postfix2/virtual, ..., postfix9/cleanup # # Note: If you use parenthesis in your regular expression, be sure they # are cloistering and not capturing: use (?:pattern) instead of (pattern). # # Performance Note: # If you do not wish to analyze any or all of postgrey, postfwd, or policyd-spf # consider simplifying $postfix_Syslog_Name to increase log scanning performance. The # more complex the RE, the longer the scan time to select/reject a log line. The # difference in scan times between the simple string 'postfix' and the more complex # alternation RE that includes postfix, postgrey, postfwd and policyd-spf is about 40%. # # Includes: postfix/smtpd, etc, postfix/policy-spf #*OnlyService = "postfix/[-\w]*" #$postfix_Syslog_Name = "postfix" # Includes: postfix/smtpd, etc, postfix/policy-spf, postgrey, postfwd, policyd-spf *OnlyService = "(?:post(?:fix|grey|fwd)|policyd-spf)(?:/[-\w]*)?" $postfix_Syslog_Name = "(?:post(?:fix|grey|fwd)|policyd-spf)" # Ignored postfix services # # Ignores postfix services postfix/SERVICE, where SERVICE is an RE # pattern. The example below will ignore log lines whose syslog # name is "postfix/myservice". #$postfix_Ignore_Service = "myservice" # Specifies the maximum report width for Detail <= 10, # or when postfix_Line_Style is not set to Truncate # $postfix_Max_Report_Width = 100 # Specifies how to handle line lengths greater than Max_Report_Width. # Options are Truncate (default), Wrap, or Full. # for Detail <= 10 # $postfix_Line_Style = Truncate # Set the variable below to the value set for "recipient_delimiter" # in your postfix configuration, if you want your recipient email # addresses split into their user + extension. # #$postfix_Recipient_Delimiter = "+" # Width of IP addresses for columnar output. Change to 40 for IPv6 addresses #$postfix_ipaddr_width = 40 $postfix_ipaddr_width = 15 # Switch to use Postfix 2.8 long queue IDs: # Postfix option: enable_long_queue_ids $postfix_Enable_Long_Queue_Ids = No # Show delays percentiles report. For command line, use --[no]delays, # without an argument. # $postfix_Show_Delays = Yes # Show names of detail section variables/command line options in # detail report titles. For command line, use --[no]sect_vars, # without an argument. # $postfix_Show_Sect_Vars = No # Show the postfix-reported hostname of 'unknown' in formatted # ip/hostname pairs. For command line, use --[no]unknown, # without an argument. # $postfix_Show_Unknown = Yes # Show the summary section. For command line, use --[no]summary, # without an argument. $postfix_Show_Summary = Yes # Specifies the percentiles shown in the delivery delays report # Valid values are from 0 to 100, inclusive. $postfix_Delays_Percentiles = "0 25 50 75 90 95 98 100" # Specifies the list of reject sections that will be output in # reports (eg. 5xx permanent or 4xx temporary failures). # Each entry in the comma or whitespace separated list consists of 3 # characters, where the first is either 4 or 5, and second and third # are a digit or a dot "." match-anything character. Also allowed is # the keyword "Warn" (which is used for postfix "warn_if_reject" rejects). # In PCRE (perl regular expression) terms, any pattern that matches: # # ^([45][0-9.][0-9.]|Warn)$ # # is acceptable. # # Typical reject codes: # # 421 Service not available, closing transmission channel # 450 Requested mail action not taken: mailbox unavailable # 451 Requested action aborted: local error in processing # 452 Requested action not taken: insufficient system storage # # 500 Syntax error, command unrecognized # 501 Syntax error in parameters or arguments # 502 Command not implemented # 503 Bad sequence of commands # 504 Command parameter not implemented # 550 Requested action not taken: mailbox unavailable # 551 User not local; please try # 552 Requested mail action aborted: exceeded storage allocation # 553 Requested action not taken: mailbox name not allowed # 554 Transaction failed # # Specific codes take priority over wildcard patterns. The default list # is: "5.. 4.. Warn". # # See also the various Reject... level limiters below # $postfix_Reject_Reply_Patterns = "5.. 4.. Warn" # Level Limiters # # The variables below control the maximum output level for a given # category. A level of 1 indicates only one level of detailed output in # the Detailed report section. The Summary section is only available # at logwatch --Detail level >= 5. Increasing the Detail level # by one adds one level of additional detail in the Summary section. # # For example, Detail 5 would output one additional level of detail, # Detail 6 two levels, etc. all the way up to 10. Finally, Detail # 11 yields uncropped lines of output. # # You can control the maximum number of level 1 lines by appending # a period and a number. The value 2.10 would indicate 2 levels # of detail, but only 10 level-1 lines. For example, setting # $postfix_Sent = 1.20 yields a top 20 list of Messages Sent. # # A more useful form of limiting uses triplets in the form l:n:t. # This triplet specifies level l, top n, and minimum threshold t. # Each of the values are integers, with l being the level limiter # as described above, n being a top n limiter for the level l, and # t being the threshold limiter for level l. When both n and t # are specified, n has priority, allowing top n lists (regardless # of threshold value). If the value of l is omitted, the speci- # fied values for n and/or t are used for all levels available in # the sub-section. This permits a simple form of wildcarding (eg. # place minimum threshold limits on all levels). However, spe- # cific limiters always override wildcard limiters. The first # form of level limiter may be included in levelspec to restrict # output, regardless of how many triplets are present. $postfix_Sent = 1 $postfix_SentLmtp = 1 $postfix_Delivered = 1 $postfix_Forwarded = 1 $postfix_ConnectionLostInbound = 1 $postfix_TimeoutInbound = 1 $postfix_ConnectToFailure = 2 # Disabled by default to reduce noise and consume less memory. # Enable at will $postfix_EnvelopeSenders = 0 $postfix_EnvelopeSenderDomains = 0 $postfix_ConnectionInbound = 0 # Reject by IP report $postfix_ByIpRejects = 0 $postfix_PanicError = 10 $postfix_FatalError = 10 $postfix_Error = 10 # warnings $postfix_Anvil = 3 $postfix_AttrError = 10 $postfix_CommunicationError = 10 $postfix_DatabaseGeneration = 10 $postfix_DNSError = 10 $postfix_HeloError = 10 $postfix_HostnameValidationError = 10 $postfix_HostnameVerification = 10 $postfix_IllegalAddrSyntax = 10 $postfix_LdapError = 10 $postfix_MailerLoop = 10 $postfix_MapProblem = 10 $postfix_MessageWriteError = 10 $postfix_NumericHostname = 10 $postfix_ProcessExit = 10 $postfix_ProcessLimit = 10 $postfix_QueueWriteError = 10 $postfix_RBLError = 10 $postfix_SaslAuthFail = 10 $postfix_SmtpConversationError = 10 $postfix_StartupError = 10 $postfix_WarningsOther = 10 # Common access control actions $postfix_Bcced = 10 $postfix_Discarded = 10 $postfix_Filtered = 10 $postfix_Hold = 10 $postfix_Prepended = 10 $postfix_Redirected = 10 $postfix_Replaced = 10 $postfix_Warned = 10 # DUNNO action not logged # IGNORE action not logged # REJECT actions are below # Rejects # The following are generic reject types, which are automatically # expanded into each reject variant, based on the reply patterns # listed in Reject_Reply_Patterns. By default, each item in the # list below becomes 4xxReject..., 5xxReject..., and WarnReject... $postfix_RejectBody = 10 $postfix_RejectClient = 10 $postfix_RejectConfigError = 10 $postfix_RejectContent = 10 $postfix_RejectData = 10 $postfix_RejectEtrn = 10 $postfix_RejectHeader = 10 $postfix_RejectHelo = 10 $postfix_RejectInsufficientSpace = 10 $postfix_RejectLookupFailure = 10 $postfix_RejectMilter = 10 $postfix_RejectProxy = 10 $postfix_RejectRBL = 10 $postfix_RejectRecip = 10 $postfix_RejectRelay = 10 $postfix_RejectSender = 10 $postfix_RejectSize = 10 $postfix_RejectUnknownClient = 10 $postfix_RejectUnknownReverseClient = 10 $postfix_RejectUnknownUser = 10 $postfix_RejectUnverifiedClient = 3 $postfix_RejectVerify = 10 # For more precise control, you can comment out any of the reject # types above and specify each variant manually, but the list must # be consistent with the values specified in Reject_Reply_Patterns. # # For example, you could comment out $postfix_RejectHelo above, and # instead uncomment the three RejectHelo variants, allowing you to # specify different level limiters to each variant: # # Permanent 5xx variant # $postfix_5xxRejectHelo = 1 # Temporary 4xx variant # $postfix_4xxRejectHelo = 2 # Warn_if_reject variant # $postfix_WarnRejectHelo = 2 # $postfix_Deferred = 10 $postfix_Deferrals = 10 $postfix_BounceLocal = 10 $postfix_BounceRemote = 10 $postfix_Discarded = 10 $postfix_ReturnedToSender = 10 $postfix_NotificationSent = 10 $postfix_ConnectionLostOutbound = 10 $postfix_Deliverable = 10 $postfix_Undeliverable = 10 $postfix_PixWorkaround = 10 $postfix_SaslAuth = 10 $postfix_TlsServerConnect = 10 $postfix_TlsClientConnect = 10 $postfix_TlsUnverified = 10 $postfix_TlsOffered = 10 $postfix_SMTPProtocolViolation = 10 $postfix_Postscreen = 1 $postfix_DNSBLog = 1 $postfix_PolicySPF = 10 $postfix_PolicydWeight = 10 $postfix_Postgrey = 10 # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/netscreen.conf0100644000000000000000000000155613040505236022335 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "netscreen" # Which logfile group... LogFile = netscreen ######################################################## # This was written and is maintained by: # Kirk Bauer # # Please send all comments, suggestions, bug reports, # etc, to kirk@kaybee.org. ######################################################## # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/in.qpopper.conf0100644000000000000000000000173313040505236022437 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "in.qpopper" # Which logfile group... LogFile = maillog # Only give lines pertaining to the in.qpopper service... *MultiService = in.qpopper,qpopper *RemoveHeaders ######################################################## # This was written and is maintained by: # Kenneth Porter # # Please send all comments, suggestions, bug reports, # etc, to shiva@well.com. ######################################################## # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/extreme-networks.conf0100644000000000000000000000157413040505236023672 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "extreme-networks" # Which logfile group... LogFile = extreme-networks ######################################################## # This was written and is maintained by: # Kirk Bauer # # Please send all comments, suggestions, bug reports, # etc, to kirk@kaybee.org. ######################################################## # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/vdr.conf0100644000000000000000000000154513040505236021140 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "vdr" # Which logfile group... LogFile = vdr ######################################################## # This was written and is maintained by: # Reiner Buehl # # Please send all comments, suggestions, bug reports, # etc, to reiner@buehl.net. ######################################################## # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/zz-lm_sensors.conf0100644000000000000000000000211513040505236023164 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "lm_sensors output" # Which logfile group... LogFile = NONE # The following variables may be set. They are commented-out because these # are the same defaults in the zz-lm_sensors script # $pathto_sensors = '/usr/bin/sensors'; # $query_hddtemp = '/usr/bin/nc 127.0.0.1 7634'; # $get_kvm_status = 'cat /proc/cpuinfo | grep -c "QEMU Virtual CPU" ######################################################## # Please send all comments, suggestions, bug reports, # etc, to logwatch-devel@logwatch.org ######################################################## # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/qmail.conf0100644000000000000000000000343013040505236021443 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "qmail" # Which logfile group... LogFile = maillog # Only give lines pertaining to the qmail service... *OnlyService = qmail *RemoveHeaders = # This sets whether to display counts of emails from each user & to each user. # Will make rather a large log file if run on a primary mail server. # Set either 0 or 1 $qmail_high_detail = 0 # Threshold controls the minimum number for: # "From this server" ($from_threshold) # "To Remote Server" ($remote_threshold) # "To Local Server" ($local_threshold) # Threshold is a global variable. # These are only used IF you have $qmail_high_detail set to 1 $threshold = 4 # From threshold is a minimum for the number of emails people send out. # This will over-ride threshold for this value. # If it is not set, the global $threshold is used. Set to 0 for all. $from_threshold = 6 # Remote threshold is a minimum for the number of emails that go to a remote server. # This will over-ride threshold for this value. # If it is not set, the global $threshold is used. Set to 0 for all. $remote_threshold = 2 # Local threshold is a minimum for the number of emails that go to this local server. # This will over-ride threshold for this value. # If it is not set, the global $threshold is used. Set to 0 for all. $local_threshold = 7 # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/sendmail.conf0100644000000000000000000001521213040505236022135 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "sendmail" # Which logfile group... LogFile = maillog # Only give lines pertaining to the sendmail service... *MultiService = sendmail,sm-mta *RemoveHeaders # Previous versions of sendmail.conf allowed for the use of the # $Sendmail_Detail variable. Because now all services have use # of the Detail variable, $Sendmail_Detail is deprecated, and may # be removed in a future version of the sendmail filter script. # How Detail affects the output of sendmail is described here: # # The Detail is used to override the general logwatch Detail # parameter that is set either when invoking logwatch (option --detail) # or specified in the conf/logwatch.conf file, in the variable Detail. # If not specified, the default is to inherit the value of the general # logwatch Detail setting. # # Example: #Detail = 5 # # The defined values of Detail are as follows: # Detail >= 0: Will print:"; # - severe errors and basic statistics"; # Detail >= 3: Print above plus:"; # - counts of errors handled by sendmail"; # Detail >= 5: Print above plus:"; # - details of errors handled by sendmail"; # Detail >= 10: Print above plus:"; # - all statistics gathered"; # Note that Detail is independent of sendmail's LogLevel. # The logwatch script should be able to handle any logging level # set in sendmail (either through confLOG_LEVEL in the *.mc files # or through LogLevel in the *.cf files). The default setting is # usually a LogLevel of 9. At level 15, for example, SMTP # transactions are logged, and the logwatch script extracts additional # information. Levels above 15 generate additional debug information, # which is filtered by the logwatch script. Therefore, setting higher # levels of LogLevel will yield larger mail log files, may provide # additional parsed information in the logwatch log, but should not # cause new unmatched entries. # All sendmail log statements that start with "DEBUG: " will be filtered. # This may be used for user-defined statements that should appear on the log, # but not reported by logwatch. # $Sendmail_PrettyHost is used to format host entries in a tabular # format. It is mostly useful when you have a very large number of # entries for errors that display host names/addresses. If not # specified, the default is 0, which indicates that no additional # host formatting is done. Set to 1 to enable the host formatting. #$Sendmail_PrettyHost = 0 # The following are examples of the use of variables SendmailMatchFilter, # Sendmail_ReportFilter, and $Sendmail_MilterHeadersToCount. # To uncomment and use these specific examples, remember to remove the '#' # from the first column. And of course, you can write your own filters. # Note that unlike the statements in the sendmail script, you must end # each line (except the last one) with a \ to denote a continuation line #$Sendmail_MatchFilter = " \ # # first we declare a scope for later use by Sendmail_ReportFilter \ # package MatchFilter; \ # our %DatabaseBuild; \ # # filter and count how many times the alias database is rebuilt \ # if ( ($User) = ($ThisLine =~ /^alias database .* rebuilt by (.*)/ ) ) { \ # $DatabaseBuild{$User}++; \ # # note that we don't need to re-assign an empty string to $ThisLine \ # # because the 'alias database' line is then ignored by the \ # # scripts/services/sendmail script. \ # } \ # \ # # here we'll choose to ignore and not report the 'lost input channel' \ # # statements \ # if ( $ThisLine =~ /^lost input channel from/ ) { \ # # we re-assign an empty string to $ThisLine to prevent further \ # # processing of this log line by the sendmail script. \ # $ThisLine = ""; \ # }" # #$Sendmail_ReportFilter = " \ # if (keys %MatchFilter::DatabaseBuild) { \ # print "\n\nDatabase re-built by:"; \ # foreach $User (keys %MatchFilter::DatabaseBuild) { \ # print "\n $User: $MatchFilter::DatabaseBuild{$User} Time(s)"; \ # } \ # }" # The $Sendmail_MilterHeadersToCount will count every header added with # one (or more) of the specified strings. Each string is specified by # delimiting it with a vertical bar, and is counted separately: $Sendmail_MilterHeadersToCount = "X-SPF|X-Spam|X-Scanned-By: MIMEDefang|Received-SPF: fail|Received-SPF: softfail" ######################################################### # Sendmail Threshold values. # These allow you to configure the output and restrict verbose reports # by limiting what is printed to occurances >= the value you enter. # # Note that case is insensitive. #Sendmail Config Values $sendmail_mailbomblistthreshold = 25 $sendmail_mailbombthreshold = 10 $sendmail_unresolveddomainsthreshold = 1 $sendmail_knownspammerthreshold = 1 $sendmail_relaydeniedthreshold = 1 $sendmail_checkmailrejectthreshold = 1 $sendmail_checkrcptrejectthreshold = 1 $sendmail_lostinputchannelthreshold = 1 $sendmail_dummyconnectionthreshold = 1 $sendmail_unknownhoststhreshold = 1 $sendmail_unknownusersthreshold = 1 $sendmail_domainerrorsthreshold = 1 $sendmail_pregreetingthreshold = 1 $sendmail_collecterrorthreshold = 1 $sendmail_timeoutthreshold = 1 $sendmail_blackholethreshold = 1 #Set this to Null to suppress the Top 10 Email Addresses $sendmail_tolistthreshold = 10 ######################################################## # Please send all comments, suggestions, bug reports, # etc, to logwatch-devel@lists.sourceforge.net ######################################################## # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/php.conf0100644000000000000000000000150213040505236021125 0ustar rootroot############################################################################### # $Id$ ############################################################################### # $Log: php.conf,v $ # Revision 1.1 2006/11/12 18:28:31 bjorn # New php service, by Jeremias Reith. # ############################################################################### # # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = php-messages # Which logfile group... LogFile = php # PHP notices should be fixed Detail = High # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/eximstats.conf0100644000000000000000000000213113040505236022356 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "EXIMSTATS" # Which logfile group... LogFile = exim # Only give lines pertaining to the mountd service... #*OnlyService = #*RemoveHeaders = # Location of eximstats executable $eximstats = "/usr/sbin/eximstats" ######################################################## # This was written and is maintained by: # Jeff Frost # # Please send all comments, suggestions, bug reports, # etc, to jeff.frost@frostconsultingllc.com and # logwatch-devel@lists.sourceforge.net ######################################################## # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/qmail-smtpd.conf0100644000000000000000000000754213040505236022600 0ustar rootroot########################################################################### # $Id$ ########################################################################### # $Log: qmail-smtpd.conf,v $ # Revision 1.3 2007/01/29 19:09:51 bjorn # Handle log entries from simscan v1.2 or later, and improved output report, # by Bob Hutchinson. # # Revision 1.2 2005/09/07 15:20:21 bjorn # Added badmailfrom/badmailto, by Bob Hutchinson # # Revision 1.1 2005/09/07 00:37:59 bjorn # New qmail multilog files written by Bob Hutchinson # ########################################################################### # for use with multilog # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "qmail-smtp" # Which logfile group... LogFile = qmail-smtpd-current # Only give lines pertaining to the qmail service... #*OnlyService = qmail *RemoveHeaders = # This sets whether to display counts of emails from each user & to each user. # Will make rather a large log file if run on a primary mail server. # Set either 0 or 1 $qmail_high_detail = 1 # Threshold controls the minimum number for all thresholds: # Threshold is a global variable. # These are only used IF you have $qmail_high_detail set to 1 $threshold = 1 # From threshold is a minimum for the number of emails people send out. # This will over-ride threshold for this value. # If it is not set, the global $threshold is used. Set to 0 for all. $from_threshold = # Remote threshold is a minimum for the number of emails that go to a remote server. # This will over-ride threshold for this value. # If it is not set, the global $threshold is used. Set to 0 for all. $to_threshold = # rbl $blocked_threshold = # chkuser # display = 1 , switch off = 0 $show_chkuser_rejects = 1 $chkuser_rejects_from_threshold = $chkuser_rejects_to_threshold = $chkuser_rejects_remote_threshold = $chkuser_rejects_reason_threshold = # display = 1 , switch off = 0 $show_chkuser_rejects_relay = 1 $chkuser_rejects_relay_from_threshold = $chkuser_rejects_relay_to_threshold = $chkuser_rejects_relay_remote_threshold = # display = 1 , switch off = 0 $show_chkuser_accepts = 1 $chkuser_accepts_from_threshold = $chkuser_accepts_to_threshold = # display = 1 , switch off = 0 $show_chkuser_accepts_relay = 1 $chkuser_accepts_relay_from_threshold = $chkuser_accepts_relay_to_threshold = # display = 1 , switch off = 0 $show_chkuser_other = 1 $chkuser_noauthresource_threshold = $chkuser_overquota_threshold = $chkuser_rejected_intrusion_threshold = # display = 1 , switch off = 0 $show_chkuser_accepted_sender = 1 $chkuser_accepted_sender_from_threshold = $chkuser_accepted_sender_remote_threshold = $chkuser_accepted_null_sender_remote_threshold = # display = 1 , switch off = 0 $show_chkuser_rejected_sender = 1 $chkuser_rejected_sender_from_threshold = $chkuser_rejected_sender_remote_threshold = $chkuser_rejected_sender_reason_threshold = # simscan $simscan_threshold = $simscan_from_threshold = $simscan_to_threshold = $simscan_attach_threshold = $simscan_regex_threshold = # passthru $show_simscan_passthru = 1 $simscan_passthru_ip_from_threshold = $simscan_passthru_from_threshold = $simscan_passthru_to_threshold = # spam_reject $show_simscan_spam_reject = 1 $simscan_spam_reject_ip_from_threshold = $simscan_spam_reject_from_threshold = $simscan_spam_reject_to_threshold = # spam_dropped $show_simscan_spam_dropped = 1 $simscan_spam_dropped_ip_from_threshold = $simscan_spam_dropped_from_threshold = $simscan_spam_dropped_to_threshold = # badmail $badmailto_ip_threshold = $badmailto_email_threshold = $badmailfrom_ip_threshold = $badmailfrom_email_threshold = # 1 or 0 $ignoreunmatched = 0 usr/share/logwatch/default.conf/services/dhcpd.conf0100644000000000000000000000170213040505236021422 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "dhcpd" # Which logfile group... LogFile = messages # Only give lines pertaining to the dhcpd service... *OnlyService = dhcpd *RemoveHeaders ######################################################## # This was written and is maintained by: # Kirk Bauer # # Please send all comments, suggestions, bug reports, # etc, to kirk@kaybee.org. ######################################################## # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/exim.conf0100644000000000000000000000167413040505236021312 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "EXIM" # Which logfile group... LogFile = exim # Only give lines pertaining to the mountd service... #*OnlyService = #*RemoveHeaders = ######################################################## # This was written and is maintained by: # Kirk Bauer # # Please send all comments, suggestions, bug reports, # etc, to kirk@kaybee.org. ######################################################## # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/qmail-send.conf0100644000000000000000000000374613040505236022404 0ustar rootroot########################################################################### # $Id$ ########################################################################### # $Log: qmail-send.conf,v $ # Revision 1.1 2005/09/07 00:37:59 bjorn # New qmail multilog files written by Bob Hutchinson # ########################################################################### # for use with multilog # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "qmail-send" # Which logfile group... LogFile = qmail-send-current # Only give lines pertaining to the qmail service... #*OnlyService = qmail *RemoveHeaders = # This sets whether to display counts of emails from each user & to each user. # Will make rather a large log file if run on a primary mail server. # Set either 0 or 1 $qmail_high_detail = 1 # Threshold controls the minimum number for: # "From this server" ($from_threshold) # "To Remote Server" ($remote_threshold) # "To Local Server" ($local_threshold) # Threshold is a global variable. # These are only used IF you have $qmail_high_detail set to 1 $threshold = 10 # From threshold is a minimum for the number of emails people send out. # This will over-ride threshold for this value. # If it is not set, the global $threshold is used. Set to 0 for all. $from_threshold = # Remote threshold is a minimum for the number of emails that go to a remote server. # This will over-ride threshold for this value. # If it is not set, the global $threshold is used. Set to 0 for all. $remote_threshold = # Local threshold is a minimum for the number of emails that go to this local server. # This will over-ride threshold for this value. # If it is not set, the global $threshold is used. Set to 0 for all. $local_threshold = usr/share/logwatch/default.conf/services/openvpn.conf0100644000000000000000000000135413040505236022030 0ustar rootroot########################################################################### # ------------------------------------------------------------------------ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "OpenVPN" # Which logfile group... LogFile = messages # Only give lines pertaining to openvpn *OnlyService = openvpn *RemoveHeaders = # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/sshd2.conf0100644000000000000000000000170213040505236021363 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "Sshd2" # Which logfile group... LogFile = messages # Only give lines pertaining to the sshd2 service... *OnlyService = sshd2 *RemoveHeaders ######################################################## # This was written and is maintained by: # Kirk Bauer # # Please send all comments, suggestions, bug reports, # etc, to kirk@kaybee.org. ######################################################## # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/pix.conf0100644000000000000000000000064613040505236021146 0ustar rootroot########################################################################### # $Id$ ########################################################################### # $Log: pix.conf,v $ # Revision 1.1 2006/12/20 04:37:13 bjorn # Config files for new service for cisco pix files. # ########################################################################### Title = "Cisco Pix" LogFile = pix # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/sonicwall.conf0100644000000000000000000000167413040505236022343 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "sonicwall" # Which logfile group... LogFile = sonicwall LogFile = messages # sonicwall does not print a service name, but it does tag its line with # "id=firewall" *OnlyService = id=firewall ######################################################## # Please send all comments, suggestions, bug reports, # etc, to logwatch-devel@lists.sourceforge.net ######################################################## # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/pam.conf0100644000000000000000000000167413040505236021125 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "pam" # Which logfile group... LogFile = messages # Only give lines pertaining to the pam service... *OnlyService = pam *RemoveHeaders ######################################################## # This was written and is maintained by: # Kirk Bauer # # Please send all comments, suggestions, bug reports, # etc, to kirk@kaybee.org. ######################################################## # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/zz-sys.conf0100644000000000000000000000170513040505236021622 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "System Configuration" # Which logfile group... LogFile = NONE # The value of 0.4 will cause this service to be displayed in front of any # other service that has the default of 0.5 DisplayOrder = 0.4 ######################################################## # Please send all comments, suggestions, bug reports, # etc, to logwatch-devel@lists.sourceforge.net ######################################################## # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/http.conf0100644000000000000000000000661513040505236021327 0ustar rootroot########################################################################### # Configuration file for http filter ########################################################################### Title = "httpd" # Which logfile group... LogFile = http # Define the log file format # # This is now the same as the LogFormat parameter in the configuration file # for httpd. Multiple instances of declared LogFormats in the httpd # configuration file can be declared here by concatenating them with the # '|' character. The default, shown below, includes the Combined Log Format, # the Common Log Format, and the default SSL log format. #$LogFormat = "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"|%h %l %u %t \"%r\" %>s %b|%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b" # The following is supported for backwards compatibility, but deprecated: # Define the log file format # # the only currently supported fields are: # client_ip # request # http_rc # bytes_transfered # agent # #$HTTP_FIELDS = "client_ip ident userid timestamp request http_rc bytes_transfered referrer agent" #$HTTP_FORMAT = "space space space brace quote space space quote quote" # Define the field formats # # the only currently supported formats are: # space = space delimited field # quote = quoted ("..") space delimited field # brace = braced ([..]) space delimited field # Flag to ignore 4xx and 5xx error messages as possible hack attempts # # Set flag to 1 to enable ignore # or set to 0 to disable $HTTP_IGNORE_ERROR_HACKS = 0 # Ignore requests # Note - will not do ANY processing, counts, etc... just skip it and go to # the next entry in the log file. # Note - The match will be case insensitive; e.g. /model/ == /MoDel/ # Examples: # 1. Ignore all URLs starting with /model/ and ending with 1 to 10 digits # $HTTP_IGNORE_URLS = ^/model/\d{1,10}$ # # 2. Ignore all URLs starting with /model/ and ending with 1 to 10 digits and # all URLS starting with /photographer and ending with 1 to 10 digits # $HTTP_IGNORE_URLS = ^/model/\d{1,10}$|^/photographer/\d{1,10}$ # or simply: # $HTTP_IGNORE_URLS = ^/(model|photographer)/\d{1,10}$ # To ignore a range of IP addresses completely from the log analysis, # set $HTTP_IGNORE_IPS. For example, to ignore all local IP addresses: # # $HTTP_IGNORE_IPS = ^10\.|^172\.(1[6-9]|2[0-9]|3[01])\.|^192\.168\.|^127\. # # For more sophisticated ignore rules, you can define HTTP_IGNORE_EVAL # to an arbitrary chunk of code. # The default is not to filter anything: $HTTP_IGNORE_EVAL = 0 # Example: # $HTTP_IGNORE_EVAL = "($field{http_rc} == 401) && ($field{client_ip}=~/^192\.168\./) && ($field{url}=~m%^/protected1/%)" # See the "scripts/services/http" script for other variables that can be tested. # The variable $HTTP_USER_DISPLAY defines which user accesses are displayed. # The default is not to display user accesses: $HTTP_USER_DISPLAY = 0 # To display access failures: # $HTTP_USER_DISPLAY = "$field{http_rc} >= 400" # To display all user accesses except "Unauthorized": # $HTTP_USER_DISPLAY = "$field{http_rc} != 401" # To raise the needed level of detail for one or more specific # error codes to display a summary instead of listing each # occurrence, set a variable like the following ones: # Raise 403 codes to detail level High #$http_rc_detail_rep_403 = 10 # Always show only summary for 404 codes #$http_rc_detail_rep_404 = 20 # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/mdadm.conf0100644000000000000000000000115413040505236021423 0ustar rootroot# You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "Mdadm" # Logwatch will try to find md devices in /etc/mdadm.conf or # /etc/mdadm/mdadm.conf. If none of these files exist it can scan actively # for md devices. Set to 'Yes' to enable active scanning: $MDADM_ENABLE_SCAN = No # Which logfile group... LogFile = NONE usr/share/logwatch/default.conf/services/pam_unix.conf0100644000000000000000000000157413040505236022167 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "pam_unix" # Which logfile group... LogFile = messages LogFile = secure ######################################################## # This was written and is maintained by: # Kirk Bauer # # Please send all comments, suggestions, bug reports, # etc, to kirk@kaybee.org. ######################################################## # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/pop3.conf0100644000000000000000000000164313040505236021225 0ustar rootroot########################################################################### # ------------------------------------------------------------------------ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "POP-3" # Which logfile group... LogFile = messages LogFile = maillog # Only give lines pertaining to courier... # I'm not sure if this is complete, especially for the new webmail daemon in 0.44.1 #but you will get at least all currently supported logs *OnlyService = (pop3d-ssl|pop3d|spop3d|tpop3d) *RemoveHeaders = # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/lvm.conf0100644000000000000000000000161713040505236021143 0ustar rootroot# You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "LVM" # Which logfile group... LogFile = messages # Only give lines pertaining to the OMSA service... *OnlyService = lvm *RemoveHeaders ######################################################### ## LVM Threshold values. ## These allow you to configure the output and restrict verbose reports ## by limiting what is printed to occurances >= the value you enter. ## ## Note that case is insensitive. # ##LVM Config Values #$pool_threshold = 0 # % full values to report #$snapshot_threshold = 0 # % full values to report # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/clamav-milter.conf0100644000000000000000000000107313040505236023076 0ustar rootroot################################################################## # # clamav script ver. 0.85.1 for Logwatch. # # Written by S. Schimkat . # # Find latest version here: www.schimkat.dk/clamav # ################################################################## Title = "Clamav-milter" LogFile = messages # maillog retained for backwards compatibility, but may be deleted # at a later time LogFile = maillog *OnlyService = clamav-milter *RemoveHeaders # To turnoff unmatched output set to 1 $clamav_ignoreunmatched = 0 # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/dpkg.conf0100644000000000000000000000141713040505236021270 0ustar rootroot########################################################################### # $Id$ ########################################################################### # $Log: dpkg.conf,v $ # Revision 1.1 2006/12/15 04:39:22 bjorn # New dpkg scripts, by Willi Mann. # ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = dpkg status changes # Which logfile group... LogFile = dpkg # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/scsi.conf0100644000000000000000000000207213040505236021302 0ustar rootroot########################################################################### # $Id$ ########################################################################### # $Log: scsi.conf,v $ # Revision 1.1 2005/05/21 23:11:51 bjorn # Submitted by Benjamin Baudoux. # ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "Kernel module scsi" LogFile = messages *OnlyService = scsi *RemoveHeaders ######################################################## # This was written and is maintained by: # cadtool@stepmind.com # # Please send all comments, suggestions, bug reports, # etc, to logwatch-devel@lists.sourceforge.net ######################################################## # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/xntpd.conf0100644000000000000000000000174013040505236021477 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "XNTPD" # Which logfile group... #LogFile = secure LogFile = messages # Only give lines pertaining to the ntpd service... *MultiService = ntpd,xntpd,ntpdate *RemoveHeaders ######################################################## # This was written and is maintained by: # Kirk Bauer # # Please send all comments, suggestions, bug reports, # etc, to kirk@kaybee.org. ######################################################## # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/barracuda.conf0100644000000000000000000000102013040505236022255 0ustar rootroot########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = Barracuda Spam Firewall # Which logfile group... LogFile = maillog # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/mod_security2.conf0100644000000000000000000000116013040505236023126 0ustar rootroot########################################################################### # Configuration file for http mod_security2 ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "ModSecurity2 (mod_security2)" # Which logfile group... LogFile = audit_log usr/share/logwatch/default.conf/services/iptables.conf0100644000000000000000000000266613040505236022155 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "iptables firewall" # Which logfile group... LogFile = messages LogFile = iptables # Set this to yes to lookup IPs in kernel firewall report $iptables_ip_lookup = No # Set this to enable a filter on iptables/ipchains displays # This will block out hosts who have less than the specified # number of hits between all ports. Defaults to 0. $iptables_host_min_count = 0 # If both of the following settings are enabled, two output lists # will be produced. If none is set, the old style output is prduced. # Set this to generate old style output (sorted by source hosts) #$iptables_list_by_host = 0 # Set this to generate new style output (sorted by targeted service) #$iptables_list_by_service = 1 ######################################################## # Please send all comments, suggestions, bug reports, # etc, to logwatch-devel@lists.sourceforge.net ######################################################## # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/stunnel.conf0100644000000000000000000000147013040505236022032 0ustar rootroot########################################################################## # $Id$ ########################################################################## # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "stunnel" # Which logfile group... LogFile = secure # Reduce output for allowed services # all services listed comma separated in the following variable will be # summarized to "how often was this service used" $STUNNEL_ALLOWED_SERVICES = "" *OnlyService = stunnel *RemoveHeaders # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/zz-zfs.conf0100644000000000000000000000153013040505236021602 0ustar rootroot########################################################################### # $Id$ ########################################################################### # Show status of ZFS pools Title = "ZFS Report" LogFile = NONE # Where your zpool and zfs commands live #$pathto_zpool = "/usr/sbin/zpool" #$pathto_zfs = "/usr/sbin/zfs" # If you want to set the detail level for zz-zfs separately from the # rest of logwatch, you can do it here: $zfs_detail = 0 # Set this to print only the summary (default if detail level is "Low") #$summary_only = 1 # Set this to print only the status detail #$detail_only = 1 ######################################################## # Please send all comments, suggestions, bug reports, # etc, to logwatch-devel@logwatch.org ######################################################## # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/zypp.conf0100644000000000000000000000113513040505236021342 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = zypp status changes # Which logfile group... LogFile = zypp # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/vpopmail.conf0100644000000000000000000000136613040505236022175 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "vpopmail" # Which logfile group... LogFile = maillog # Only give lines pertaining to the qmail service... *OnlyService = vpopmail *RemoveHeaders = # Do you want to report succeful logins? $successful_logins = 0 # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/syslogd.conf0100644000000000000000000000171013040505236022023 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "Syslogd" # Which logfile group... LogFile = messages # Only give lines pertaining to the syslogd service... *OnlyService = syslogd *RemoveHeaders ######################################################## # This was written and is maintained by: # Kirk Bauer # # Please send all comments, suggestions, bug reports, # etc, to kirk@kaybee.org. ######################################################## # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/rt314.conf0100644000000000000000000000034513040505236021217 0ustar rootroot############################################################################# # $Id$ ############################################################################# Title = "RT314" LogFile = rt314 # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/vsftpd.conf0100644000000000000000000000136513040505236021653 0ustar rootroot # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = vsftpd-messages # Which logfile group... LogFile = vsftpd # *OnlyService = vsftpd *RemoveHeaders = # Set this to 1 if you want to ignore unmatched FTP messages... $vsftpd_ignore_unmatched = 0 # NOTE: Be sure to add these to your FTP server's vsftpd.conf file: # (NOT this logwatch configuration file) # xferlog_enable=YES # xferlog_std_format=YES # dual_log_enable=YES # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/sshd.conf0100644000000000000000000000344613040505236021310 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "SSHD" # Which logfile group... LogFile = secure LogFile = messages # Only give lines pertaining to the sshd service... *OnlyService = sshd *RemoveHeaders # Variable $sshd_ignore_host is used to filter out hosts that login # successfully. This commented-out example filters out reserved local # addresses (IETF RFC 1918 and RFC 3330). #$sshd_ignore_host="^10\.|^172\.(1[6-9]|2[0-9]|3[01])\.|^192\.168\.|^127\." # The refused connections report lists every ip that is refused even if # it was only refused 1 or 2 times. In a case like that I don't care # to see the information. It is just noise. I want to know when a # a connection has been refused 10, 20, 30 times because that is an # indication of an attack or a problem. # Set this variable to a positive integer to trim out the lower count # refused connections from the report. i.e. 10 would not show any hosts # with less than 10 refusals. # This has no effect if the $Detail variable is greater than 5. #$refused_connections_threshold = 10 ######################################################## # This was written and is maintained by: # Kirk Bauer # # Please send all comments, suggestions, bug reports, # etc, to kirk@kaybee.org. ######################################################## # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/kernel.conf0100644000000000000000000000271513040505236021625 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "Kernel" # Which logfile group... LogFile = messages # Only give lines pertaining to the kernel service... *OnlyService = (kernel|SUNW,[-\w]+?) *RemoveHeaders # Ignore segfaults and general protection faults in the listed programs # The value is a regular expression that the executable name is matched # against. Separate multiple executables with | # $ignore_faults = npviewer.bin # Ignore Error: state manager encountered RPCSEC_GSS session expired against NFSv4 server # messages which often occur when kerberos tickets expire # $ignore_rpcsec_expired = Yes # Ignore messages matching the given regex # $kernel_ignore_messages = A TPM error \(6\) occurred ######################################################## # This was written and is maintained by: # Kirk Bauer # # Please send all comments, suggestions, bug reports, # etc, to kirk@kaybee.org. ######################################################## # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/fail2ban.conf0100644000000000000000000000226013040505236022016 0ustar rootroot# $Log: fail2ban.conf,v $ # Revision 1.1 2006/05/30 19:04:26 bjorn # Added fail2ban service, written by Yaroslav Halchenko. # ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = fail2ban-messages # Which logfile group... LogFile = fail2ban LogFile = messages # Only give lines pertaining to the fail2ban service. Don't use # OnlyService because fail2ban.log does not use the syslog format. # Note: fail2ban logs using "service" names fail2ban, fail2ban.jail, # fail2ban.filter, and many more. We want to exclude fail2ban-client # so we reject fail2ban- *OnlyContains = fail2ban([^-]|).*\[[0-9]+\] # Cannot use *OnlyService or *RemoveHeaders in cases where fail2ban logs # to fail2ban.log due to different date/header format. You can if fail2ban # is logging to syslog. # *OnlyService = fail2ban(|\..+) # *RemoveHeaders usr/share/logwatch/default.conf/services/dnssec.conf0100644000000000000000000000514713040505236021626 0ustar rootroot############################################################################# # $Id$ ############################################################################# # $Log: dnssec.conf,v $ # Revision 1.1 2005/10/19 05:57:40 bjorn # dnssec and resolver scripts, written by Lindy Foster # ############################################################################# #Copyright (c) 2004, Sparta, Inc #All rights reserved. # #Redistribution and use in source and binary forms, with or without #modification, are permitted provided that the following conditions are met: # #* Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # #* Redistributions in binary form must reproduce the above copyright # notice, this list of conditions and the following disclaimer in the # documentation and/or other materials provided with the distribution. # #* Neither the name of Sparta, Inc nor the names of its contributors may # be used to endorse or promote products derived from this software # without specific prior written permission. # #THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS ``AS #IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, #THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR #PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDERS OR #CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, #EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, #PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; #OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, #WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR #OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF #ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ############################################################################# ############################################################################# # These scripts were created as part of the dnssec-tools project. # For more information, see http://sourceforge.net/dnssec-tools. # Detailed instructions for setting up BIND 9.3.* to use these logwatch # configuration files and scripts are containted in the README file # on sourceforge. ############################################################################# ########################################################################### # Configuration file for dnssec filter ########################################################################### Title = "DNSSEC" # Which logfile group... LogFile = dnssec usr/share/logwatch/default.conf/services/http-error.conf0100644000000000000000000000061213040505236022445 0ustar rootroot# # Service definition for http error log # # File to be placed in # /etc/logwatch/conf/services/http-error.conf # Title = http errors # Which logfile group... LogFile = http-error # PHP notices should be fixed Detail = High # Ignore all "does not exist" messages # $ignore_not_exist_all = Yes # Ignore "does not exist" messages with no "referer:" tag # $ignore_not_exist_no_referer = Yes usr/share/logwatch/default.conf/services/pluto.conf0100644000000000000000000000045713040505236021511 0ustar rootroot########################################################################## # $Id$ ########################################################################## # This is very simple. The FreeS/WAN watcher doesn't do a whole lot. :) Title = "FreeS/WAN" LogFile = secure # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/proftpd-messages.conf0100644000000000000000000000215713040505236023630 0ustar rootroot########################################################################### # $Id$ ########################################################################### # This is for the ProFTPD daemon, if you have it on your system # If you don't it won't hurt anything. # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "proftpd-messages" # Which logfile group... LogFile = messages LogFile = secure *OnlyService = proftpd *RemoveHeaders # Set this to 1 if you want to ignore unmatched FTP messages... $ftpd_ignore_unmatched = 0 ######################################################## # This was written and is maintained by: # Kirk Bauer # # Please send all comments, suggestions, bug reports, # etc, to kirk@kaybee.org. ######################################################## # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/pam_pwdb.conf0100644000000000000000000000171313040505236022133 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "PAM_pwdb" # Which logfile group... LogFile = messages # Only give lines pertaining to the PAM_pwdb service... *OnlyService = pam_pwdb *RemoveHeaders ######################################################## # This was written and is maintained by: # Kirk Bauer # # Please send all comments, suggestions, bug reports, # etc, to kirk@kaybee.org. ######################################################## # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/secure.conf0100644000000000000000000000304313040505236021626 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "Connections (secure-log)" # Which logfile group... LogFile = secure # Whether or not to lookup the IPs into hostnames... # Setting this to Yes will significantly increase runtime $secure_ip_lookup = No # Use this to ignore certain services in the secure log. # You can ignore as many services as you would like. # (we ignore sshd because its entries are processed by the sshd script) $ignore_services = sshd Pluto stunnel proftpd saslauthd imapd postfix/smtpd # For these services, summarize only (i.e. don't least each IP, just # list the number of connections total) #$summarize_connections = ftp # Use secure_[servicename] to add a floor to the output #Example this limits the output to only pop3 connects greater then 500 #$secure_pop3 = 500 ######################################################## # This was written and is maintained by: # Kirk Bauer # # Please send all comments, suggestions, bug reports, # etc, to kirk@kaybee.org. ######################################################## # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/named.conf0100644000000000000000000000211013040505236021416 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "Named" # Which logfile group... LogFile = messages # Whether or not to lookup the IPs into hostnames... # Setting this to Yes will significantly increase runtime $named_ip_lookup = No # Only give lines pertaining to the named service... *OnlyService = named *RemoveHeaders ######################################################## # This was written and is maintained by: # Kirk Bauer # # Please send all comments, suggestions, bug reports, # etc, to kirk@kaybee.org. ######################################################## # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/smartd.conf0100644000000000000000000000126113040505236021632 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "Smartd" # Which logfile group... LogFile = messages # Only give lines pertaining to the smartd service... *OnlyService = smartd *RemoveHeaders # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/samba.conf0100644000000000000000000000154513040505236021430 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "samba" # Which logfile group... LogFile = samba ######################################################## # This was written and is maintained by: # Kirk Bauer # # Please send all comments, suggestions, bug reports, # etc, to kirk@kaybee.org. ######################################################## # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/qmail-pop3d.conf0100644000000000000000000000340613040505236022471 0ustar rootroot########################################################################### # $Id$ ########################################################################### # $Log: qmail-pop3d.conf,v $ # Revision 1.1 2005/09/07 00:37:59 bjorn # New qmail multilog files written by Bob Hutchinson # ########################################################################### # for use with multilog # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "qmail-pop3" # Which logfile group... LogFile = qmail-pop3d-current # Only give lines pertaining to the qmail service... #*OnlyService = qmail *RemoveHeaders = # This sets whether to display counts of emails from each user & to each user. # Will make rather a large log file if run on a primary mail server. # Set either 0 or 1 $qmail_high_detail = 1 # Threshold controls the minimum number for: # "From this server" ($from_threshold) # "To Remote Server" ($remote_threshold) # "To Local Server" ($local_threshold) # Threshold is a global variable. # These are only used IF you have $qmail_high_detail set to 1 $threshold = 10 # From threshold is a minimum for the number of emails people send out. # This will over-ride threshold for this value. # If it is not set, the global $threshold is used. Set to 0 for all. $from_threshold = # Remote threshold is a minimum for the number of emails that go to a remote server. # This will over-ride threshold for this value. # If it is not set, the global $threshold is used. Set to 0 for all. $to_threshold = usr/share/logwatch/default.conf/services/clamav.conf0100644000000000000000000000136013040505236021603 0ustar rootroot################################################################## # # clamav script ver. 0.85.1 for Logwatch. # # Written by S. Schimkat . # # Find latest version here: www.schimkat.dk/clamav # ################################################################## Title = "Clamav" # If you log to syslog, you probably want... LogFile = messages *applystddate *OnlyService = clamd # If clamd logs to a file directly, you want only... # (comment out *OnlyService above) #LogFile = clamav *RemoveHeaders # To turnoff unmatched output set to 1 $clamav_ignoreunmatched = 0 # To set a detail level different from the global one, uncomment # and set it to an appropriate number #$clamav_detail_level = 5 # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/sssd.conf0100644000000000000000000000101313040505236021307 0ustar rootroot# You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "SSSD" # Which logfile group... LogFile = messages # Only give lines pertaining to the sssd service... *OnlyService = sssd *RemoveHeaders # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/evtapplication.conf0100644000000000000000000000175613040505236023373 0ustar rootroot########################################################################## # $Id$ ########################################################################## # $Log: evtapplication.conf,v $ # Revision 1.1 2007/04/28 22:50:24 bjorn # Added files for Windows Event Log, by Orion Poplawski. These are for # Windows events logged to a server, using Snare Agent or similar. # ########################################################################## # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "Application Event Log" # Which logfile group... LogFile = eventlog # Only give lines pertaining to the kernel service... *EventLogOnlyService = Application *RemoveHeaders # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/sudo.conf0100644000000000000000000000153613040505236021317 0ustar rootroot# You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "Sudo (secure-log)" # Which logfile group... LogFile = secure # Only give lines pertaining to the sudo service... *OnlyService = sudo *RemoveHeaders # number of times same command $0 run by same user for summary only to be # generated at low detail level $command_run_threshold = 0 # List of commands to ignore. Format is a comma separated list of: # from_user;tu_user;command # from_user can be ANY to match any user # command is a regular expression # $ignore_commands = # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/clam-update.conf0100644000000000000000000000347713040505236022547 0ustar rootroot######################################################################### # clam-update script for Logwatch # Analyzes the Clam Anti-Virus update log # # Version: 1.0.0 # Initial release # Version: 1.0.1 # Minor documentation update # # Written by: Lars Skjrlund ######################################################################### ######################################################################### # This script is subject to the same copyright as Logwatch itself ######################################################################### ######################################################################### # Files - all shown with default paths: # # /usr/share/logwatch/default.conf/logfiles/clam-update.conf # /usr/share/logwatch/default.conf/services/clam-update.conf (this file) # /usr/share/logwatch/scripts/services/clam-update # # ... and of course # # /var/log/clam-update ######################################################################### ######################################################################### # Important note: # # Under normal operation - ie. a detail level of 'lo' (0), no output will # be produced if no updates have taken place. However, if no update # attempt has been done, an alert will be output to inform you about this # (which probably means that freshclam isn't running). # # If you have stopped using ClamAV and would like to get rid of the # alert, you should delete the logfile. If there's no logfile, no alerts # will be output - but if Logwatch finds a logfile and no update attempts # have been made for whatever timeperiod Logwatch is analyzing, an alert # will be output. ######################################################################### Title = "clam-update" # Which logfile group... LogFile = clam-update # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/dirsrv.conf0100644000000000000000000000076313040505236021657 0ustar rootroot# You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "Directory Server" # Which logfile group... LogFile = dirsrv #*OnlyService = Server_Administrator #*RemoveHeaders # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/syslog-ng.conf0100644000000000000000000000175713040505236022274 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "Syslog-ng" # Which logfile group... LogFile = messages # Only give lines pertaining to the syslogd service... *OnlyService = "syslog-ng\[[0-9]*\]" *RemoveHeaders ######################################################## # This was written and is maintained by: # Stefan Jakobs # # Please send all comments, suggestions, bug reports, # etc, to logwatch at localside.net. ######################################################## # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/ftpd-xferlog.conf0100644000000000000000000000170213040505236022741 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "ftpd-xferlog" # Which logfile group... LogFile = xferlog # Set this to 0 to just get a summary of transfers (no details) $detail_transfer=1 ######################################################## # This was written and is maintained by: # Kirk Bauer # # Please send all comments, suggestions, bug reports, # etc, to kirk@kaybee.org. ######################################################## # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/cron.conf0100644000000000000000000000154313040505236021304 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "Cron" # Which logfile group... LogFile = cron ######################################################## # This was written and is maintained by: # Kirk Bauer # # Please send all comments, suggestions, bug reports, # etc, to kirk@kaybee.org. ######################################################## # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/shaperd.conf0100644000000000000000000000127013040505236021766 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "Shaperd" # Which logfile group... LogFile = messages # Only give lines pertaining to the modprobe service... *OnlyService = shaperd\d *RemoveHeaders # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/automount.conf0100644000000000000000000000171613040505236022400 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "Automount" # Which logfile group... LogFile = messages # Only give lines pertaining to the automount service... *OnlyService = automount *RemoveHeaders ######################################################## # This was written and is maintained by: # Kirk Bauer # # Please send all comments, suggestions, bug reports, # etc, to kirk@kaybee.org. ######################################################## # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/tivoli-smc.conf0100644000000000000000000000115513040505236022430 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = Tivoli Storage Manager Client # Which logfile group... LogFile = tivoli-smc # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/cyrus.conf0100644000000000000000000000103013040505236021477 0ustar rootroot# You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "Cyrus" # Which logfile group... LogFile = imapd # Only give lines pertaining to cyrus... # I'm not sure if this is complete *OnlyService = (imap|imaps|master|ctl_cyrusdb|tls_prune) usr/share/logwatch/default.conf/services/audit.conf0100644000000000000000000000234513040505236021452 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "Kernel Audit" # Which logfile group... LogFile = messages # Only give lines related to the audit service # Note that audit lines may have something like audit(1114839915.618:0) # as the service name # (Some implementations might not precede it with "kernel:") *OnlyService = (kernel:( \[[ 0-9\.]+\])?)?\s*(type=[0-9]+\s*)?audit.* # Need to distinguish between the various audit services *RemoveHeaders = "^... .. ..:..:.. [^ ]* (?:kernel: )?" ######################################################## # This was written and is maintained by: # Ron Kuris # # Please send all comments, suggestions, bug reports, # etc, to logwatch-devel@lists.sourceforge.net ######################################################## usr/share/logwatch/default.conf/services/evtsecurity.conf0100644000000000000000000000174513040505236022735 0ustar rootroot########################################################################## # $Id$ ########################################################################## # $Log: evtsecurity.conf,v $ # Revision 1.1 2007/04/28 22:50:24 bjorn # Added files for Windows Event Log, by Orion Poplawski. These are for # Windows events logged to a server, using Snare Agent or similar. # ########################################################################## # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "Security Event Log" # Which logfile group... LogFile = eventlog # Only give lines pertaining to the kernel service... *EventLogOnlyService = security *RemoveHeaders # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/citadel.conf0100644000000000000000000000175213040505236021752 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "Citadel" # Which logfile group... LogFile = citadel # Only give lines pertaining to the citadel service... *OnlyService = "citadel|citserver" *RemoveHeaders ######################################################## # This was written and is maintained by: # Stefan Jakobs # # Please send all comments, suggestions, bug reports, # etc, to logwatch at localside.net. ######################################################## # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/systemd.conf0100644000000000000000000000102113040505236022022 0ustar rootroot# You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "Systemd" # Which logfile group... LogFile = messages # Only give lines pertaining to the OMSA service... *OnlyService = systemd *RemoveHeaders # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/spamassassin.conf0100644000000000000000000000111013040505236023036 0ustar rootroot################################################################## # SpamAssassin spamd logs # ################################################################## Title = "SpamAssassin" LogFile = spamassassin LogFile = maillog # Pull in sendmail for matching msgid to sender for statistics *OnlyService = (spamd|sendmail) *RemoveHeaders # Ignore connections from these hosts. # The value is a regular expression that the hostname plus IP address is matched # against. Separate multiple hosts/IPs with | # $ignore_connections = myspamclient.mydomain # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/amavis.conf0100644000000000000000000001647113040505236021631 0ustar rootroot ########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "Amavisd-new" # Which logfile group... LogFile = maillog # Specifies the global maximum detail level # #Detail = 10 # Only give lines pertaining to the amavis service... # # The variables OnlyService and amavis_Syslog_Name are regular # expression patterns, and should both be set to match the # amavis service name used in your syslog entries. #*OnlyService = (usr/sbin/amavisd|dccproc) *OnlyService = (amavis|dccproc) *RemoveHeaders # Set this to the service name used in amavis syslog entries # # Note: if you use parenthesis in your regular expression, be sure it # is cloistering and not capturing: use (?:pattern) instead of (pattern). # $amavis_Syslog_Name = "/usr/sbin/amavisd" $amavis_Syslog_Name = "(?:amavis|dccproc)" # # Set the variable below to specify the maximum report width. # for Detail <= 10 # $amavis_Max_Report_Width = 100 # Specifies how to handle line lengths greater than Max_Report_Width. # Options are Truncate (default), Wrap, or Full. # for Detail <= 10 # $amavis_Line_Style = Truncate # Show names of detail section variables/command line options in # detail report titles. For command line, use --[no]sect_vars, # without an argument. # $amavis_Show_Sect_Vars = No # In reports, for tallying purposes, use (and show) only the first # recipient when a message contains multple recipients. # $amavis_Show_First_Recip_Only = No # Include a by-contents category grouping in the summary report. # $amavis_Show_By_Ccat_Summary = Yes # Amavis Timings Report # # Specifies the percentiles of collected data to show in the timing report. # Valid values are from 0 to 100, inclusive. # $amavis_Timings_Percentiles = "0 5 25 50 75 95 100" # # Show top N percent of the amavis scan timings report # $amavis_Timings = 95 # Amavis SpamAssassin Timings Report # # Specifies the percentiles of collected data to show in the # SpamAssassin timing report (requires amavis 2.6+, SA 3.3+). # Valid values are from 0 to 100, inclusive. # $amavis_SA_Timings_Percentiles = "0 5 25 50 75 95 100" # # Show top N rows of the SpamAssassin timings report # Requires: amavis 2.6+, SpamAssassin 3.3+ # $amavis_SA_Timings = 100 # Spam Score Percentiles Report # # Specifies the percentiles shown in the spam scores frequency report. # Valid values range from 0 to 100, inclusive. The keyword "default" # can be used instead to reset the values to their built-in default. # $amavis_Score_Percentiles = "0 50 90 95 98 100" # Spam Score Frequency Report # # Specifies the buckets shown in the spam scores frequency report. # Valid values are real numbers. The keyword "default" # can be used instead to reset the values to their built-in default. # $amavis_Score_Frequencies = "-10 -5 0 5 10 20 30" # SpamAssassin Spam / Ham Rules Hit Report # # Specifies the number of top S spam and top H ham hits to show in the # SpamAssassin Spam and Ham rules hit report. The value is a list # separated by whitespace or a comma. The order is "spam,ham". The # keyword "all" means unlimited limit, and 0 specifies none. For # example, the value "all,10" would show all Spam rules hit, but only # the top 10 ham rules, whereas "0,all" would prevent the Spam hit # report, and show all the hit Ham rules. # $amavis_SARules = "20 20" # Autolearn Report # # Shows the autolearn report when autolearn entries are present in # amavis log entries. To make these available, the default # $log_templ variable needs to be modified. This can be done by # uncommenting two lines in the amavis program itself (where the # default log templates reside), by correctly adding the $log_templ # variable to the amavisd.conf file. See amavis' README.customize # and the end of the amavisd program, searching for "autolearn". $amavis_Show_Autolearn = Yes # If available, show most recent amavis startup details # $amavis_Show_StartInfo = Yes # Show the summary section. For command line, use --[no]summary, # without an argument. $amavis_Show_Summary = Yes # Level Limiters # # The variables below control the maximum output level for a given # category. A level of 1 indicates only one level of detailed output # in the Detailed report section. The Summary section is only avail- # able at logwatch --Detail level >= 5. Increasing the Detail level # by one adds one level of additional detail in the Summary section. # # For example, Detail 5 would output one additional level of detail, # Detail 6 two levels, etc. all the way up to 10. Finally, Detail # 11 yields uncropped lines of output. # # You can control the maximum number of level 1 lines by appending # a period and a number. The value 2.10 would indicate 2 levels # of detail, but only 10 level 1 lines. For example, setting # $amavis_SpamBlocked = 1.20 yields a top 20 list of blocked spam. # # A more useful form of limiting uses triplets in the form l:n:t. # This triplet specifies level l, top n, and minimum threshold t. # Each of the values are integers, with l being the level limiter # as described above, n being a top n limiter for the level l, and # t being the threshold limiter for level l. When both n and t # are specified, n has priority, allowing top n lists (regardless # of threshold value). If the value of l is omitted, the speci- # fied values for n and/or t are used for all levels available in # the sub-section. This permits a simple form of wildcarding (eg. # place minimum threshold limits on all levels). However, spe- # cific limiters always override wildcard limiters. The first # form of level limiter may be included in levelspec to restrict # output, regardless of how many triplets are present. $amavis_CleanPassed = 0 $amavis_CleanBlocked = 10 $amavis_SpamPassed = 10 $amavis_SpamBlocked = 10 $amavis_SpammyPassed = 10 $amavis_SpammyBlocked = 10 $amavis_MalwarePassed = 10 $amavis_MalwareBlocked = 10 $amavis_BannedNamePassed = 10 $amavis_BannedNameBlocked = 10 $amavis_BadHeaderPassed = 10 $amavis_BadHeaderBlocked = 10 $amavis_MTABlocked = 10 $amavis_OversizedBlocked = 10 $amavis_OtherBlocked = 10 $amavis_AVConnectFailure = 10 $amavis_AVTimeout = 10 $amavis_ArchiveExtract = 10 $amavis_BadHeaderSupp = 10 $amavis_Bayes = 10 $amavis_Blacklisted = 10 $amavis_BounceKilled = 10 $amavis_BounceRescued = 10 $amavis_BounceUnverifiable = 10 $amavis_ContentType = 10 $amavis_DccError = 10 $amavis_DefangError = 10 $amavis_Defanged = 10 $amavis_DsnNotification = 10 $amavis_DsnSuppressed = 10 $amavis_ExtraModules = 10 $amavis_FakeSender = 10 $amavis_LocalDeliverySkipped = 10 $amavis_MalwareByScanner = 10 $amavis_MalwareToSpam = 10 $amavis_MimeError = 10 $amavis_p0f = 2 $amavis_Released = 10 $amavis_SADiags = 10 $amavis_SmtpResponse = 10 $amavis_TmpPreserved = 10 $amavis_VirusScanSkipped = 1 $amavis_Warning = 10 $amavis_WarningAddressModified = 2 $amavis_WarningNoQuarantineID = 1 $amavis_WarningSecurity = 10 $amavis_WarningSmtpShutdown = 10 $amavis_WarningSQL = 10 $amavis_Whitelisted = 10 # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/ipop3d.conf0100644000000000000000000000152213040505236021536 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "ipop3d" # Which logfile group... LogFile = maillog LogFile = secure *OnlyService = ipop3d *RemoveHeaders ######################################################## # The ipop3d filter was written and is maintained by: # Pawel Jarosz ######################################################## # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/portsentry.conf0100644000000000000000000000172313040505236022574 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "PortSentry" # Which logfile group... LogFile = messages # Only give lines pertaining to the portsentry service... *OnlyService = portsentry *RemoveHeaders = ######################################################## # This was written and is maintained by: # Kirk Bauer # # Please send all comments, suggestions, bug reports, # etc, to kirk@kaybee.org. ######################################################## # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/mountd.conf0100644000000000000000000000170513040505236021651 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "Mountd" # Which logfile group... LogFile = messages # Only give lines pertaining to the mountd service... *OnlyService = mountd *RemoveHeaders ######################################################## # This was written and is maintained by: # Kirk Bauer # # Please send all comments, suggestions, bug reports, # etc, to kirk@kaybee.org. ######################################################## # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/mysql-mmm.conf0100644000000000000000000000116713040505236022276 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "MySQL Multi-Master Replication Manager" # Which logfile group... LogFile = mysql-mmm # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/courier.conf0100644000000000000000000000333713040505236022016 0ustar rootroot########################################################################### # ------------------------------------------------------------------------ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "courier mail services" # Which logfile group... LogFile = maillog # Because the Courier Mail Server has very generic service names (pop3d # etc.), it might sometimes be necessary to disable courier. $courier_enable=1 #Level of Detail # 0 (Default) only errors #>=5 Successful deliveries, pop3 and imap connections #>=10 For the I like -vvv people (currently not big differences) #$courier_override_detail_level=5 # Output format # 0 make IPtables-Like output # 1 make nicely-formatted tables # Default to 0 because that fits # better with the rest of logwatch $courier_tables=0 #Print the Output of the command mailq $courier_PrintMailQueue=0 #0: "502 ESMTP command error",cmd: DATA or 517-Domain does not exist: boss.com. #1: "502 ESMTP command error" or 517-Domain does not exist #Last means of course a reduction of tables but also a loss of information. #Currently only in Table mode #$courier_RemoveAdditionalInfo=0 #Change this to 1 if you want to do reverse DNS lookups $courier_ip_lookup=0 # Allows to print all unmatched lines (only useful if courier # is the only service that logs to maillog) #$courier_print_all_unmatched=0 # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/services/fetchmail.conf0100644000000000000000000000155013040505236022275 0ustar rootroot########################################################################### # $Id$ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "Fetchmail" # Which logfile group... LogFile = maillog *OnlyService = fetchmail *RemoveHeaders #Fetchmail Global ENV Variables ######################################################## # This was written and is maintained by: # Oron Peled # ######################################################## # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/default.conf/logwatch.conf0100644000000000000000000001217013040505236020326 0ustar rootroot######################################################## # This was written and is maintained by: # Kirk Bauer # # Please send all comments, suggestions, bug reports, # etc, to kirk@kaybee.org. # ######################################################## # NOTE: # All these options are the defaults if you run logwatch with no # command-line arguments. You can override all of these on the # command-line. # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of = . Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 # Default Log Directory # All log-files are assumed to be given relative to this directory. LogDir = /var/log # You can override the default temp directory (/tmp) here TmpDir = /var/cache/logwatch #Output/Format Options #By default Logwatch will print to stdout in text with no encoding. #To make email Default set Output = mail to save to file set Output = file Output = stdout #To make Html the default formatting Format = html Format = text #To make Base64 [aka uuencode] Encode = base64 Encode = none # Default person to mail reports to. Can be a local account or a # complete email address. Variable Output should be set to mail, or # --output mail should be passed on command line to enable mail feature. MailTo = root # WHen using option --multiemail, it is possible to specify a different # email recipient per host processed. For example, to send the report # for hostname host1 to user@example.com, use: #Mailto_host1 = user@example.com # Multiple recipients can be specified by separating them with a space. # Default person to mail reports from. Can be a local account or a # complete email address. MailFrom = Logwatch # if set, the results will be saved in instead of mailed # or displayed. Be sure to set Output = file also. #Filename = /tmp/logwatch # Use archives? If set to 'Yes', the archives of logfiles # (i.e. /var/log/messages.1 or /var/log/messages.1.gz) will # be searched in addition to the /var/log/messages file. # This usually will not do much if your range is set to just # 'Yesterday' or 'Today'... it is probably best used with # By default this is now set to Yes. To turn off Archives uncomment this. #Archives = No # Range = All # The default time range for the report... # The current choices are All, Today, Yesterday Range = yesterday # The default detail level for the report. # This can either be Low, Med, High or a number. # Low = 0 # Med = 5 # High = 10 Detail = Low # The 'Service' option expects either the name of a filter # (in /usr/share/logwatch/scripts/services/*) or 'All'. # The default service(s) to report on. This should be left as All for # most people. Service = All # You can also disable certain services (when specifying all) Service = "-zz-network" # Prevents execution of zz-network service, which # prints useful network configuration info. Service = "-zz-sys" # Prevents execution of zz-sys service, which # prints useful system configuration info. Service = "-eximstats" # Prevents execution of eximstats service, which # is a wrapper for the eximstats program. # If you only cared about FTP messages, you could use these 2 lines # instead of the above: #Service = ftpd-messages # Processes ftpd messages in /var/log/messages #Service = ftpd-xferlog # Processes ftpd messages in /var/log/xferlog # Maybe you only wanted reports on PAM messages, then you would use: #Service = pam_pwdb # PAM_pwdb messages - usually quite a bit #Service = pam # General PAM messages... usually not many # You can also choose to use the 'LogFile' option. This will cause # logwatch to only analyze that one logfile.. for example: #LogFile = messages # will process /var/log/messages. This will run all the filters that # process that logfile. This option is probably not too useful to # most people. Setting 'Service' to 'All' above analyzes all LogFiles # anyways... # # By default we assume that all Unix systems have sendmail or a sendmail-like MTA. # The mailer code prints a header with To: From: and Subject:. # At this point you can change the mailer to anything that can handle this output # stream. # TODO test variables in the mailer string to see if the To/From/Subject can be set # From here with out breaking anything. This would allow mail/mailx/nail etc..... -mgt mailer = "/usr/sbin/sendmail -t" # # With this option set to a comma separted list of hostnames, only log entries # for these particular hosts will be processed. This can allow a log host to # process only its own logs, or Logwatch can be run once per a set of hosts # included in the logfiles. # Example: HostLimit = hosta,hostb,myhost # # The default is to report on all log entries, regardless of its source host. # Note that some logfiles do not include host information and will not be # influenced by this setting. # #HostLimit = myhost # vi: shiftwidth=3 tabstop=3 et usr/share/logwatch/scripts/0040755000000000000000000000000013040505236014770 5ustar rootrootusr/share/logwatch/scripts/logwatch.pl0100755000000000000000000016366213040505236017153 0ustar rootroot#!/usr/bin/perl -w use strict; ########################################################################## ########################################################################## # Most current version can always be found at: # ftp://ftp.logwatch.org/pub/linux (tarball) # ftp://ftp.logwatch.org/pub/redhat/RPMS (RPMs) ######################################################## # Specify version and build-date: my $Version = '7.4.3'; my $VDate = '04/27/16'; ####################################################### # Logwatch was written and is maintained by: # Kirk Bauer # # Unless otherwise specified, Logwatch and all bundled filter scripts # are Copyright (c) Kirk Bauer and covered under the included MIT/X # Consortium license. # # Please send all comments, suggestions, bug reports, # etc, to logwatch@logwatch.org. # ######################################################## ############################################################################ # ENV SETTINGS: # About the locale: some functions use locale information. In particular, # Logwatch makes use of strftime, which makes use of LC_TIME variable. Other # functions may also use locale information. # # Because the parsing must be in the same locale as the logged information, # and this appears to be "C", "POSIX", or "en_US", we set LC_ALL for # this and other scripts invoked by this script. We use "C" because it # is always (?) available, whereas POSIX or en_US may not. They all use # the same time formats and rely on the ASCII character set. # # Variables REAL_LANG and REAL_LC_ALL keep the original values for use by # scripts that need native language. $ENV{'REAL_LANG'}=$ENV{'LANG'} if $ENV{'LANG'}; $ENV{'REAL_LC_ALL'}=$ENV{'LC_ALL'} if $ENV{'LC_ALL'}; # Setting ENV for scripts invoked by this script. $ENV{'LC_ALL'} = "C"; # Using setlocale to set locale for this script. use POSIX qw(locale_h); setlocale(LC_ALL, "C"); my $BaseDir = "/usr/share/logwatch"; my $ConfigDir = "/etc/logwatch"; my $PerlVersion = "$^X"; ############################################################################# ############################################################################# # SET LIBS, GLOBALS, and DEFAULTS use Getopt::Long; use POSIX qw(uname); use File::Temp qw/ tempdir /; eval "use lib \"$BaseDir/lib\";"; eval "use Logwatch \':dates\'"; my (%Config, @ServiceList, @LogFileList, %ServiceData, %LogFileData); my (@AllShared, @AllLogFiles, @FileList); # These need to not be global variables one day my (@ReadConfigNames, @ReadConfigValues); # Default config here... $Config{'detail'} = 0; # if MAILTO is set in the environment, grab it, as it may be used by cron # or anacron if ($ENV{'MAILTO'}) { $Config{'mailto'} = $ENV{'MAILTO'}; } else { $Config{'mailto'} = "root"; } $Config{'mailfrom'} = "Logwatch"; $Config{'subject'} = ""; $Config{'filename'} = ""; $Config{'range'} = "yesterday"; $Config{'debug'} = 0; $Config{'archives'} = 1; $Config{'tmpdir'} = "/var/cache/logwatch"; $Config{'numeric'} = 0; $Config{'pathtocat'} = "cat"; $Config{'pathtozcat'} = "zcat"; $Config{'pathtobzcat'} = "bzcat"; $Config{'pathtoxzcat'} = "xzcat"; $Config{'output'} = "stdout"; #8.0 $Config{'format'} = "text"; #8.0 $Config{'encode'} = "none"; #8.0 $Config{'hostformat'} = "none"; #8.0 $Config{'html_wrap'} = 80; $Config{'supress_ignores'} = 0; if (-e "$ConfigDir/conf/html/header.html") { $Config{'html_header'} = "$ConfigDir/conf/html/header.html"; } elsif (-e "$BaseDir/dist.conf/html/header.html") { $Config{'html_header'} = "$BaseDir/dist.conf/html/header.html"; } else { $Config{'html_header'} = "$BaseDir/default.conf/html/header.html"; } if (-e "$ConfigDir/conf/html/footer.html") { $Config{'html_footer'} = "$ConfigDir/conf/html/footer.html"; } elsif (-e "$BaseDir/dist.conf/html/footer.html") { $Config{'html_footer'} = "$BaseDir/dist.conf/html/footer.html"; } else { $Config{'html_footer'} = "$BaseDir/default.conf/html/footer.html"; } # Logwatch now does some basic searching for logs # So if the log file is not in the log path it will check /var/adm # and then /var/log -mgt $Config{'logdir'} = "/var/log"; #Added to create switches for different os options -mgt #Changed to POSIX to remove calls to uname and hostname my ($OSname, $hostname, $release, $version, $machine) = POSIX::uname(); $Config{'hostname'} = "$hostname"; my %wordsToInts = (yes => 1, no => 0, true => 1, false => 0, on => 1, off => 0, high => 10, med => 5, medium => 5, low => 0); ############################################################################# ############################################################################# #Load CONFIG, READ OPTIONS, make adjustments # Load main config file... if ($Config{'debug'} > 8) { print "\nDefault Config:\n"; &PrintConfig(); } &CleanVars(); # For each of the configuration sets (logwatch.conf here, and # logfiles,and services later), we do the following: # 1. read the different configuration files # 2. for each parameter, if it is cummulative, check if # it the special case empty string # 3. check to see if duplicate @ReadConfigNames = (); @ReadConfigValues = (); &ReadConfigFile ("$BaseDir/default.conf/logwatch.conf", ""); &ReadConfigFile ("$BaseDir/dist.conf/logwatch.conf", ""); &ReadConfigFile ("$ConfigDir/conf/logwatch.conf", ""); &ReadConfigFile ("$ConfigDir/conf/override.conf", "logwatch"); for (my $i = 0; $i <= $#ReadConfigNames; $i++) { if ($ReadConfigNames[$i] eq "logfile") { if ($ReadConfigValues[$i] eq "") { @LogFileList = (); } elsif (! grep(/^$ReadConfigValues[$i]$/, @LogFileList)) { push @LogFileList, $ReadConfigValues[$i]; } } elsif ($ReadConfigNames[$i] eq "service") { if ($ReadConfigValues[$i] eq "") { @ServiceList = (); } elsif (! grep(/^$ReadConfigValues[$i]$/, @ServiceList)) { push @ServiceList, $ReadConfigValues[$i]; } } else { $Config{$ReadConfigNames[$i]} = $ReadConfigValues[$i]; } } &CleanVars(); if ($Config{'debug'} > 8) { print "\nConfig After Config File:\n"; &PrintConfig(); } # Options time... my @TempLogFileList = (); my @TempServiceList = (); my $Help = 0; my $ShowVersion = 0; my ($tmp_mailto, $tmp_savefile); &GetOptions ("d|detail=s" => \$Config{'detail'}, "l|logfile=s@" => \@TempLogFileList, "logdir=s" => \$Config{'logdir'}, "s|service=s@" => \@TempServiceList, "m|mailto=s" => \$tmp_mailto, "filename=s" => \$tmp_savefile, "a|archives" => \$Config{'archives'}, "debug=s" => \$Config{'debug'}, "r|range=s" => \$Config{'range'}, "n|numeric" => \$Config{'numeric'}, "h|help" => \$Help, "u|usage" => \$Help, "v|version" => \$ShowVersion, "hostname=s" => \$Config{'hostname'}, "o|output=s" => \$Config{'output'}, "f|format=s" => \$Config{'format'}, "e|encode=s" => \$Config{'encode'}, "hostformat=s" => \$Config{'hostformat'}, "hostlimit=s" => \$Config{'hostlimit'}, "html_wrap=s" => \$Config{'html_wrap'}, "subject=s" => \$Config{'subject'} ) or &Usage(); $Help and &Usage(); #Catch option exceptions and extra logic here -mgt if ($Config{'range'} =~ /help/i) { &RangeHelpDM(); exit(0); } if ($ShowVersion) { print "Logwatch $Version (released $VDate)\n"; exit 0; } if ($tmp_mailto) { $Config{'mailto'} = $tmp_mailto; $Config{'output'} = "mail"; #8.0 } if ($tmp_savefile) { $Config{'filename'} = $tmp_savefile; $Config{'output'} = "file"; #8.0 } if ($Config{'hostformat'} eq "splitmail") { $Config{'output'} = "mail"; #8.0 #split hosts 1 long output stream #split hosts multiple output streams -mgt } &CleanVars(); #Init Output vars -mgt my $index_par=0; my @format = (250); my %out_body; my @reports = (); my $out_head =''; my $out_mime =''; my $out_reference =''; my $out_foot =''; #Eval wrapper for MIME::Base64. Perl 5.6.1 does not include it. #So Solaris 9 will break with out this. -mgt #8.0 Catch encode types here if ( $Config{'encode'} eq "base64" ) { eval "require MIME::Base64"; if ($@) { print STDERR "No MIME::Base64 installed can not use --encode\n"; } else { import MIME::Base64; } } #Reset save file now if we are going ot use it and it exists -mgt if (($Config{'filename'} ne "") && (-e "$Config{'filename'}") ) { unlink "$Config{'filename'}"; } #Check fallback to stdout if output is mail and no mailto exists -mgt if ( ($Config{'output'} eq "mail") && ($Config{'mailto'} eq "") ) { $Config{'output'} = "stdout"; } if ($Config{'debug'} > 8) { print "\nCommand Line Parameters:\n Log File List:\n"; &PrintStdArray(@TempLogFileList); print "\n Service List:\n"; &PrintStdArray(@TempServiceList); print "\nConfig After Command Line Parsing:\n"; &PrintConfig(); } if ($#TempLogFileList > -1) { @LogFileList = @TempLogFileList; for (my $i = 0; $i <= $#LogFileList; $i++) { $LogFileList[$i] = lc($LogFileList[$i]); } @ServiceList = (); } if ($#TempServiceList > -1) { @ServiceList = @TempServiceList; for (my $i = 0; $i <= $#ServiceList; $i++) { $ServiceList[$i] = lc($ServiceList[$i]); } } if ( ($#ServiceList == -1) and ($#LogFileList == -1) ) { push @ServiceList, 'all'; } if ($Config{'debug'} > 5) { print "\nConfig After Everything:\n"; &PrintConfig(); } ############################################################################# # Find out what services are defined... my @TempAllServices = (); my @services = (); my (@CmdList, @CmdArgList, @Separators, $ThisFile, $count); foreach my $ServicesDir ("$BaseDir/default.conf", "$BaseDir/dist.conf", "$ConfigDir/conf") { if (-d "$ServicesDir/services") { opendir(SERVICESDIR, "$ServicesDir/services") or die "$ServicesDir $!"; while (defined($ThisFile = readdir(SERVICESDIR))) { if ((-f "$ServicesDir/services/$ThisFile") && (!grep (/^$ThisFile$/, @services)) && ($ThisFile =~ /\.conf$/)) { push @services, $ThisFile; } } closedir SERVICESDIR; } } foreach my $f (@services) { my $ThisService = lc $f; $ThisService =~ s/\.conf$//; push @TempAllServices, $ThisService; # @Separators tells us where each of the config files start, and # is used only for the commands (entries that start with '*') @ReadConfigNames = (); @ReadConfigValues = (); @Separators = (); push (@Separators, scalar(@ReadConfigNames)); &ReadConfigFile("$BaseDir/default.conf/services/$f", ""); push (@Separators, scalar(@ReadConfigNames)); &ReadConfigFile("$BaseDir/dist.conf/services/$f", ""); push (@Separators, scalar(@ReadConfigNames)); &ReadConfigFile("$ConfigDir/conf/services/$f",""); push (@Separators, scalar(@ReadConfigNames)); &ReadConfigFile("$ConfigDir/conf/override.conf", "services/$ThisService"); @CmdList = (); @CmdArgList = (); # set the default for DisplayOrder (0.5), which should be a fraction of any precision between 0 and 1 $ServiceData{$ThisService}{'displayorder'} = 0.5; for (my $i = 0; $i <= $#ReadConfigNames; $i++) { if (grep(/^$i$/, @Separators)) { $count = 0; } if ($ReadConfigNames[$i] eq 'logfile') { if ($ReadConfigValues[$i] eq "") { @{$ServiceData{$ThisService}{'logfiles'}} = (); } elsif (! grep(/^$ReadConfigValues[$i]$/, @{$ServiceData{$ThisService}{'logfiles'}})) { push @{$ServiceData{$ThisService}{'logfiles'}}, $ReadConfigValues[$i]; } } elsif ($ReadConfigNames[$i] =~ /^\*/) { if ($count == 0) { @CmdList = (); @CmdArgList = (); } $count++; push (@CmdList, $ReadConfigNames[$i]); push (@CmdArgList, $ReadConfigValues[$i]); } else { $ServiceData{$ThisService}{$ReadConfigNames[$i]} = $ReadConfigValues[$i]; } } for my $i (0..$#CmdList) { $ServiceData{$ThisService}{+sprintf("%03d-%s", $i, $CmdList[$i])} = $CmdArgList[$i]; } } my @AllServices = sort @TempAllServices; # Find out what logfiles are defined... my @logfiles = (); foreach my $LogfilesDir ("$BaseDir/default.conf", "$BaseDir/dist.conf", "$ConfigDir/conf") { if (-d "$LogfilesDir/logfiles") { opendir(LOGFILEDIR, "$LogfilesDir/logfiles") or die "$LogfilesDir $!"; while (defined($ThisFile = readdir(LOGFILEDIR))) { if ((-f "$LogfilesDir/logfiles/$ThisFile") && (!grep (/^$ThisFile$/, @logfiles))) { push @logfiles, $ThisFile; } } closedir LOGFILEDIR; } } for $ThisFile (@logfiles) { my $ThisLogFile = $ThisFile; if ($ThisLogFile =~ s/\.conf$//i) { push @AllLogFiles, $ThisLogFile; @ReadConfigNames = (); @ReadConfigValues = (); @Separators = (); push (@Separators, scalar(@ReadConfigNames)); &ReadConfigFile("$BaseDir/default.conf/logfiles/$ThisFile", ""); push (@Separators, scalar(@ReadConfigNames)); &ReadConfigFile("$BaseDir/dist.conf/logfiles/$ThisFile", ""); push (@Separators, scalar(@ReadConfigNames)); &ReadConfigFile("$ConfigDir/conf/logfiles/$ThisFile", ""); push (@Separators, scalar(@ReadConfigNames)); &ReadConfigFile("$ConfigDir/conf/override.conf", "logfiles/$ThisLogFile"); @CmdList = (); @CmdArgList = (); @{$LogFileData{$ThisLogFile}{'logfiles'}} = (); @{$LogFileData{$ThisLogFile}{'archives'}} = (); for (my $i = 0; $i <= $#ReadConfigNames; $i++) { if (grep(/^$i$/, @Separators)) { $count = 0; } my @TempLogFileList; if ($ReadConfigNames[$i] eq "logfile") { #Lets try and find the logs -mgt if ($ReadConfigValues[$i] eq "") { @{$LogFileData{$ThisLogFile}{'logfiles'}} = (); } else { if ($ReadConfigValues[$i] !~ m=^/=) { foreach my $dir ("$Config{'logdir'}/", "/var/adm/", "/var/log/", "") { # We glob to obtain filenames. We reverse in case # we use the decimal suffix (.0, .1, etc.) in filenames #@TempLogFileList = reverse(glob($dir . $ReadConfigValues[$i])); @TempLogFileList = sort{ ($b =~ /(\d+)$/) <=> ($a =~ /(\d+)$/) || uc($a) cmp uc($b) }(glob($dir . $ReadConfigValues[$i])); # And we check for existence once again, since glob # may return the search pattern if no files found. last if (@TempLogFileList && (-e $TempLogFileList[0])); } } else { #@TempLogFileList = reverse(glob($ReadConfigValues[$i])); @TempLogFileList = sort{ ($b =~ /(\d+)$/) <=> ($a =~ /(\d+)$/) || uc($a) cmp uc($b) }(glob($ReadConfigValues[$i])); } # We attempt to remove duplicates. # Same applies to archives, in the next block. foreach my $TempLogFileName (@TempLogFileList) { if (grep(/^\Q$TempLogFileName\E$/, @{$LogFileData{$ThisLogFile}{'logfiles'}})) { if ($Config{'debug'} > 2) { print "Removing duplicate LogFile file $TempLogFileName from $ThisFile configuration.\n"; } } else { if (-e $TempLogFileName) { push @{$LogFileData{$ThisLogFile}{'logfiles'}}, $TempLogFileName; } } } } } elsif (($ReadConfigNames[$i] eq "archive") && ( $Config{'archives'} == 1)) { if ($ReadConfigValues[$i] eq "") { @{$LogFileData{$ThisLogFile}{'archives'}} = (); } else { if ($ReadConfigValues[$i] !~ m=^/=) { foreach my $dir ("$Config{'logdir'}/", "/var/adm/", "/var/log/", "") { # We glob to obtain filenames. We reverse in case # we use the decimal suffix (.0, .1, etc.) in filenames #@TempLogFileList = reverse(glob($dir . $ReadConfigValues[$i])); @TempLogFileList = sort{ ($b =~ /(\d+)$/) <=> ($a =~ /(\d+)$/) || uc($a) cmp uc($b) }(glob($dir . $ReadConfigValues[$i])); # And we check for existence once again, since glob # may return the search pattern if no files found. last if (@TempLogFileList && (-e $TempLogFileList[0])); } } else { #@TempLogFileList = reverse(glob($ReadConfigValues[$i])); @TempLogFileList = sort{ ($b =~ /(\d+)$/) <=> ($a =~ /(\d+)$/) || uc($a) cmp uc($b) }(glob($ReadConfigValues[$i])); } # We attempt to remove duplicates. This time we also check # against the LogFile declarations. foreach my $TempLogFileName (@TempLogFileList) { if (grep(/^\Q$TempLogFileName\E$/, @{$LogFileData{$ThisLogFile}{'archives'}}) || grep(/^\Q$TempLogFileName\E$/, @{$LogFileData{$ThisLogFile}{'logfiles'}}) ) { if ($Config{'debug'} > 2) { print "Removing duplicate Archive file $TempLogFileName from $ThisFile configuration.\n"; } } else { if (-e $TempLogFileName) { push @{$LogFileData{$ThisLogFile}{'archives'}}, $TempLogFileName; } } } } } elsif ($ReadConfigNames[$i] =~ /^\*/) { if ($count == 0) { @CmdList = (); @CmdArgList = (); } $count++; push (@CmdList, $ReadConfigNames[$i]); push (@CmdArgList, $ReadConfigValues[$i]); } else { $LogFileData{$ThisLogFile}{$ReadConfigNames[$i]} = $ReadConfigValues[$i]; } } for my $i (0..$#CmdList) { $LogFileData{$ThisLogFile}{+sprintf("%03d-%s", $i, $CmdList[$i])} = $CmdArgList[$i]; } } } # Find out what shared functions are defined... opendir(SHAREDDIR, "$BaseDir/scripts/shared") or die "$BaseDir/scripts/shared/, $!\n"; while (defined($ThisFile = readdir(SHAREDDIR))) { unless (-d "$BaseDir/scripts/shared/$ThisFile") { push @AllShared, lc($ThisFile); } } closedir(SHAREDDIR); if ($Config{'debug'} > 5) { print "\nAll Services:\n"; &PrintStdArray(@AllServices); print "\nAll Log Files:\n"; &PrintStdArray(@AllLogFiles); print "\nAll Shared:\n"; &PrintStdArray(@AllShared); } ############################################################################# # Time to expand @ServiceList, using @LogFileList if defined... if ((scalar @ServiceList > 0) && (grep /^all$/i, @ServiceList)) { # This means we are doing *all* services ... but excluding some my %tmphash; foreach my $item (@AllServices) { $tmphash{lc $item} = ""; } foreach my $service (@ServiceList) { next if $service =~ /^all$/i; if ($service =~ /^\-(.+)$/) { my $offservice = lc $1; if (! grep (/^$offservice$/, @AllServices)) { die "Nonexistent service to disable: $offservice\n"; } if (exists $tmphash{$offservice}) { delete $tmphash{$offservice}; } } else { die "Wrong configuration entry for \"Service\", if \"All\" selected, only \"-\" items are allowed\n"; } } @ServiceList = (); foreach my $keys (keys %tmphash) { push @ServiceList, $keys; } @LogFileList = (); } else { my $ThisOne; while (defined($ThisOne = pop @LogFileList)) { unless ($LogFileData{$ThisOne}) { die "Logwatch is not configured to use logfile: $ThisOne\n"; } foreach my $ThisService (keys %ServiceData) { for (my $i = 0; $i <= $#{$ServiceData{$ThisService}{'logfiles'}}; $i++) { if ( $ServiceData{$ThisService}{'logfiles'}[$i] eq $ThisOne ) { push @ServiceList,$ThisService; } } } } @TempServiceList = sort @ServiceList; @ServiceList = (); my $LastOne = ""; while (defined($ThisOne = pop @TempServiceList)) { unless ( ($ThisOne eq $LastOne) or ($ThisOne eq 'all') or ($ThisOne =~ /^-/)) { unless ($ServiceData{$ThisOne}) { die "Logwatch does not know how to process service: $ThisOne\n"; } push @ServiceList, $ThisOne; } $LastOne = $ThisOne; } } # Now lets fill up @LogFileList again... foreach my $ServiceName (@ServiceList) { foreach my $LogName ( @{$ServiceData{$ServiceName}{'logfiles'} } ) { unless ( grep m/^$LogName$/, @LogFileList ) { push @LogFileList, $LogName; } } } if ($Config{'debug'} > 7) { print "\n\nAll Service Data:\n"; &PrintServiceData(); print "\nServices that will be processed:\n"; &PrintStdArray(@ServiceList); print "\n\n"; print "\n\nAll LogFile Data:\n"; &PrintLogFileData(); print "\nLogFiles that will be processed:\n"; &PrintStdArray(@LogFileList); print "\n\n"; } ############################################################################# # check for existence of previous logwatch directories opendir(TMPDIR, $Config{'tmpdir'}) or die "$Config{'tmpdir'} $!"; my @old_dirs = grep { /^logwatch\.\w{8}$/ && -d "$Config{'tmpdir'}/$_" } readdir(TMPDIR); if (@old_dirs) { print "You have old files in your logwatch tmpdir ($Config{'tmpdir'}):\n\t"; print join("\n\t", @old_dirs); print "\nThe directories listed above were most likely created by a\n"; print "logwatch run that failed to complete successfully. If so, you\n"; print "may delete these directories.\n\n"; } closedir(TMPDIR); if (!-w $Config{'tmpdir'}) { my $err_str = "You do not have permission to create a temporary directory"; $err_str .= " under $Config{'tmpdir'}."; if ($> !=0) { $err_str .= " You are not running as superuser."; } $err_str .= "\n"; die $err_str; } #Set very strict permissions because we deal with security logs umask 0177; #Making temp dir with File::Temp -mgt my $cleanup = 0; if ($Config{'debug'} < 100) { $cleanup = 1; } my $TempDir = tempdir( 'logwatch.XXXXXXXX', DIR => $Config{tmpdir}, CLEANUP => $cleanup ); if ($Config{'debug'}>7) { print "\nMade Temp Dir: " . $TempDir . " with tempdir\n"; } unless ($TempDir =~ m=/$=) { $TempDir .= "/"; } ############################################################################# # Set up the environment... $ENV{'LOGWATCH_DATE_RANGE'} = $Config{'range'}; $ENV{'LOGWATCH_GLOBAL_DETAIL'} = $Config{'detail'}; $ENV{'LOGWATCH_OUTPUT_TYPE'} = $Config{'output'}; #8.0 $ENV{'LOGWATCH_FORMAT_TYPE'} = $Config{'format'}; #8.0 $ENV{'LOGWATCH_DEBUG'} = $Config{'debug'}; $ENV{'LOGWATCH_TEMP_DIR'} = $TempDir; $ENV{'LOGWATCH_NUMERIC'} = $Config{'numeric'}; $ENV{'HOSTNAME'} = $Config{'hostname'}; $ENV{'OSname'} = $OSname; #split and splitmail also play with LOGWATCH_ONLY_HOSTNAME which is not shown by debug if ($Config{'hostlimit'}) { #Pass the list to ENV with out touching it $ENV{'LOGWATCH_ONLY_HOSTNAME'} = $Config{'hostlimit'}; } if ($Config{'debug'}>4) { foreach ('LOGWATCH_DATE_RANGE', 'LOGWATCH_GLOBAL_DETAIL', 'LOGWATCH_OUTPUT_TYPE', 'LOGWATCH_FORMAT_TYPE', 'LOGWATCH_TEMP_DIR', 'LOGWATCH_DEBUG', 'LOGWATCH_ONLY_HOSTNAME') { if ($ENV{$_}) { print "export $_='$ENV{$_}'\n"; } } } my $LibDir = "$BaseDir/lib"; if ($ENV{PERL5LIB}) { # User dirs should be able to override this setting $ENV{PERL5LIB} = "$ENV{PERL5LIB}:$LibDir"; } else { $ENV{PERL5LIB} = $LibDir; } ############################################################################# unless ($Config{'logdir'} =~ m=/$=) { $Config{'logdir'} .= "/"; } # Okay, now it is time to do pre-processing on all the logfiles... my @EnvList = (); my $LogFile; foreach $LogFile (@LogFileList) { next if ($LogFile eq 'none'); if (!defined($LogFileData{$LogFile}{'logfiles'})) { print "*** Error: There is no logfile defined. Do you have a $ConfigDir/conf/logfiles/" . $LogFile . ".conf file ?\n"; next; } @FileList = $TempDir . $LogFile . "-archive"; push @FileList, @{$LogFileData{$LogFile}{'logfiles'}}; my $DestFile = $TempDir . $LogFile . "-archive"; my $Archive; foreach $Archive (@{$LogFileData{$LogFile}{'archives'}}) { if ($Archive =~ /'/) { print "File $Archive has invalid embedded quotes. File ignored.\n"; next; } my $CheckTime; # We need to find out what's the earliest log we need my @time_t = TimeBuild(); if ($Config{'range'} eq 'all') { if ($Config{'archives'} == 0) { # range is 'all', but we don't get archive files $CheckTime = time; } else { # range is 'all', and we get all archive files $CheckTime = 0; } } elsif ($time_t[0]) { # range is something else, and we need to get one # day ahead. A day has 86400 seconds. (We double # that to deal with different timezones.) $CheckTime = $time_t[0] - 86400*2; } else { # range is wrong print STDERR "ERROR: Range \'$Config{'range'}\' not understood\n"; RangeHelpDM(); exit 1; } #Archives are cat'd without any filters then cat'd along with the normal log file my @FileStat = stat($Archive); if ($CheckTime <= ($FileStat[9])) { if (($Archive =~ m/gz$/) && (-f "$Archive") && (-s "$Archive")) { my $arguments = "'${Archive}' >> $DestFile"; system("$Config{'pathtozcat'} $arguments") == 0 or die "system '$Config{'pathtozcat'} $arguments' failed: $?" } elsif (($Archive =~ m/bz2$/) && (-f "$Archive") && (-s "$Archive")) { my $arguments = "'${Archive}' 2>/dev/null >> $DestFile"; system("$Config{'pathtobzcat'} $arguments") == 0 or die "system '$Config{'pathtobzcat'} $arguments' failed: $?" } elsif (($Archive =~ m/xz$/) && (-f "$Archive") && (-s "$Archive")) { my $arguments = "'${Archive}' 2>/dev/null >> $DestFile"; system("$Config{'pathtoxzcat'} $arguments") == 0 or die "system '$Config{'pathtoxzcat'} $arguments' failed: $?" } elsif ((-f "$Archive") && (-s "$Archive")) { my $arguments = "'${Archive}' >> $DestFile"; system("$Config{'pathtocat'} $arguments") == 0 or die "system '$Config{'pathtocat'} $arguments' failed: $?" } #End if/elsif existence } #End if $CheckTime } #End Archive my $FileText = ""; foreach my $ThisFile (@FileList) { #Existence check for files -mgt next unless (-f $ThisFile); if ($ThisFile =~ /'/) { print "File $ThisFile has invalid embedded quotes. File ignored.\n"; next; } if (! -r $ThisFile) { print "File $ThisFile is not readable. Check permissions."; if ($> != 0) { print " You are not running as superuser."; } print "\n"; next; } #FIXME - We have a bug report for filenames with spaces, can be caught here needs test -mgt $FileText .= ("'" . $ThisFile . "' "); } #End foreach ThisFile # remove the ENV entries set by previous service foreach my $Parm (@EnvList) { delete $ENV{$Parm}; } @EnvList = (); my $FilterText = " "; foreach (sort keys %{$LogFileData{$LogFile}}) { my $cmd = $_; if ($cmd =~ s/^\d+-\*//) { if (-f "$ConfigDir/scripts/shared/$cmd") { $FilterText .= ("| $PerlVersion $ConfigDir/scripts/shared/$cmd '$LogFileData{$LogFile}{$_}'" ); } elsif (-f "$BaseDir/scripts/shared/$cmd") { $FilterText .= ("| $PerlVersion $BaseDir/scripts/shared/$cmd '$LogFileData{$LogFile}{$_}'" ); } else { die "Cannot find shared script $cmd\n"; } } elsif ($cmd =~ s/^\$//) { push @EnvList, $cmd; $ENV{$cmd} = $LogFileData{$LogFile}{$_}; if ($Config{'debug'}>4) { print "export $cmd='$LogFileData{$LogFile}{$_}'\n"; } } } #Hostlimit filter need to add ability to negate this use "NoHostFilter = Yes" in logfile like samba -mgt if ( ($Config{'hostlimit'}) && (!$LogFileData{$LogFile}{'nohostfilter'}) ) { #Pass the list to ENV with out touching it $ENV{'LOGWATCH_ONLY_HOSTNAME'} = $Config{'hostlimit'}; $FilterText .= ("| $PerlVersion $BaseDir/scripts/shared/onlyhost"); } if (opendir (LOGDIR, "$ConfigDir/scripts/logfiles/" . $LogFile)) { foreach (sort readdir(LOGDIR)) { unless ( -d "$ConfigDir/scripts/logfiles/$LogFile/$_") { $FilterText .= ("| $PerlVersion $ConfigDir/scripts/logfiles/$LogFile/$_"); } } closedir (LOGDIR); } if (opendir (LOGDIR, "$BaseDir/scripts/logfiles/" . $LogFile)) { foreach (sort readdir(LOGDIR)) { unless (( -d "$BaseDir/scripts/logfiles/$LogFile/$_") or # if in ConfigDir, then the ConfigDir version is used ( -f "$ConfigDir/scripts/logfiles/$LogFile/$_")) { $FilterText .= ("| $PerlVersion $BaseDir/scripts/logfiles/$LogFile/$_"); } } closedir (LOGDIR); } #Instead of trying to cat non-existent logs we test for it above -mgt if ($FileText) { my $Command = $FileText . $FilterText . ">" . $TempDir . $LogFile; if ($Config{'debug'}>4) { print "\nPreprocessing LogFile: " . $LogFile . "\n" . $Command . "\n"; } if ($LogFile !~ /^[-_\w\d]+$/) { print STDERR "Unexpected filename: [[$LogFile]]. Not used\n" } else { #System call does the log processing system("$Config{'pathtocat'} $Command") == 0 or die "system '$Config{'pathtocat'} $Command' failed: $?" } } } #populate the host lists if we're splitting hosts #It seems this is run after the file is parsed so it is done 2 times? #Can it be put inline with the above filters? my @hosts; if ($Config{'hostformat'} ne "none") { #8.0 my $newlogfile; my @logarray; opendir (LOGDIR,$TempDir) || die "Cannot open dir"; @logarray = readdir(LOGDIR); closedir (LOGDIR); my $ecpcmd = ("| $PerlVersion $BaseDir/scripts/shared/hostlist"); #Note hostlist and hosthash [which is never used] exist to build list of host names seen foreach $newlogfile (@logarray) { my $eeefile = ("$TempDir" . "$newlogfile"); if ((!(-d $eeefile)) && (!($eeefile =~ m/-archive/))) { system("$Config{'pathtocat'} $eeefile $ecpcmd") == 0 or die "system '$Config{'pathtocat'} $eeefile $ecpcmd' failed: $?" } } #read in the final host list open (HOSTFILE,"$TempDir/hostfile") || die $!; @hosts = ; close (HOSTFILE); chomp @hosts; #fixme check the sort? #@hosts = sort(@hosts); } ############################################################################# my $report_finish = "\n ###################### Logwatch End ######################### \n\n"; my $printing = ''; my $emailopen = ''; #################################################################### #Call Parse logs if ($Config{'hostformat'} ne "none") { my $Host; foreach $Host (@hosts) { $printing = ''; $ENV{'LOGWATCH_ONLY_HOSTNAME'} = $Host; $Config{'hostname'} = $Host; #resetting hostname here makes it appear in output header -mgt parselogs(); } # ECP } else { parselogs(); } #Close Filehandle is needed -mgt close(OUTFILE) unless ($Config{'output'} eq "stdout"); ############################################################################# exit(0); ############################################################################# #END MAIN ############################################################################# ###################################################################### #sub getInt #Notes: Called by CleanVars ###################################################################### sub getInt { my $word = shift; unless (defined($word)) { return $word; } my $tmpWord = lc $word; $tmpWord =~ s/\W//g; return $wordsToInts{$tmpWord} if (defined $wordsToInts{$tmpWord}); unless ($word =~ s/^"(.*)"$/$1/) { return lc $word; } return $word; } ###################################################################### #sub CleanVars #Notes: Called during #Load CONFIG, READ OPTIONS, make adjustments ###################################################################### sub CleanVars { foreach (keys %Config) { unless (defined $Config{$_} and $_ eq "hostname") { $Config{$_} = getInt($Config{$_}); } } } ###################################################################### #sub PrintStdArray # ###################################################################### sub PrintStdArray (@) { my @ThisArray = @_; my $i; for ($i=0;$i<=$#ThisArray;$i++) { print "[" . $i . "] = " . $ThisArray[$i] . "\n"; } } ###################################################################### #sub PrintConfig # ###################################################################### sub PrintConfig () { # for debugging, print out config... foreach (keys %Config) { print $_ . ' -> ' . $Config{$_} . "\n"; } print "Service List:\n"; &PrintStdArray(@ServiceList); print "\n"; print "LogFile List:\n"; &PrintStdArray(@LogFileList); print "\n\n"; } ###################################################################### #sub PrintServiceData # ###################################################################### # for debugging... sub PrintServiceData () { my ($ThisKey1,$ThisKey2,$i); foreach $ThisKey1 (keys %ServiceData) { print "\nService Name: " . $ThisKey1 . "\n"; foreach $ThisKey2 (keys %{$ServiceData{$ThisKey1}}) { next unless ($ThisKey2 =~ /^\d+-/); print " $ThisKey2 = $ServiceData{$ThisKey1}{$ThisKey2}\n"; } for ($i=0;$i<=$#{$ServiceData{$ThisKey1}{'logfiles'}};$i++) { print " Logfile = " . $ServiceData{$ThisKey1}{'logfiles'}[$i] . "\n"; } } } ###################################################################### #sub PrintLogFileData # ###################################################################### # for debugging... sub PrintLogFileData () { my ($ThisKey1,$ThisKey2,$i); foreach $ThisKey1 (keys %LogFileData) { print "\nLogfile Name: " . $ThisKey1 . "\n"; foreach $ThisKey2 (keys %{$LogFileData{$ThisKey1}}) { next unless ($ThisKey2 =~ /^\d+-/); print " $ThisKey2 = $LogFileData{$ThisKey1}{$ThisKey2}\n"; } for ($i=0;$i<=$#{$LogFileData{$ThisKey1}{'logfiles'}};$i++) { print " Logfile = " . $LogFileData{$ThisKey1}{'logfiles'}[$i] . "\n"; } for ($i=0;$i<=$#{$LogFileData{$ThisKey1}{'archives'}};$i++) { print " Archive = " . $LogFileData{$ThisKey1}{'archives'}[$i] . "\n"; } if ($LogFileData{$ThisKey1}{'nohostfilter'}) { print " NoHostFilter = " . $LogFileData{$ThisKey1}{'nohostfilter'} . "\n"; } } } ###################################################################### #sub ReadConfigFile # ###################################################################### sub ReadConfigFile { my $FileName = $_[0]; my $Prefix = $_[1]; if ( ! -f $FileName ) { return(0); } if ($Config{'debug'} > 5) { print "ReadConfigFile: Opening " . $FileName . "\n"; } open (READCONFFILE, $FileName) or die "Cannot open file $FileName: $!\n"; my $line; while ($line = ) { if ($Config{'debug'} > 9) { print "ReadConfigFile: Read Line: " . $line; } $line =~ s/\#.*\\\s*$/\\/; $line =~ s/\#.*$//; next if ($line =~ /^\s*$/); if ($Prefix) { next if ($line !~ m/\Q$Prefix:\E/); $line =~ s/\Q$Prefix:\E//; } if ($line =~ s/\\\s*$//) { $line .= ; redo unless eof(READCONFFILE); } my ($name, $value) = split /=/, $line, 2; $name =~ s/^\s+//; $name =~ s/\s+$//; if ($value) { $value =~ s/^\s+//; $value =~ s/\s+$//; } else { $value = ''; } push @ReadConfigNames, lc $name; push @ReadConfigValues, getInt $value; if ($Config{'debug'} > 7) { print "ReadConfigFile: Name=" . $name . ", Value=" . $value . "\n"; } } close READCONFFILE; } ######################################################################### #sub Usage # ######################################################################### sub Usage () { # Show usage for this program print "\nUsage: $0 [--detail ] [--logfile ] [--output ]\n" . " [--format ] [--encode ] [--numeric]\n" . " [--mailto ] [--archives] [--range ] [--debug ]\n" . " [--filename ] [--help|--usage] [--version] [--service ]\n" . " [--hostformat ] [--hostlimit ] [--html_wrap ]\n\n"; print "--detail : Report Detail Level - High, Med, Low or any #.\n"; print "--logfile : *Name of a logfile definition to report on.\n"; print "--logdir : Name of default directory where logs are stored.\n"; print "--service : *Name of a service definition to report on.\n"; print "--output : Report Output - stdout [default], mail, file.\n"; #8.0 print "--format : Report Format - text [default], html.\n"; #8.0 print "--encode : Enconding to use - none [default], base64.\n"; #8.0 print "--mailto : Mail report to .\n"; print "--archives: Use archived log files too.\n"; print "--filename : Used to specify they filename to save to. --filename [Forces output to file].\n"; print "--range : Date range: Yesterday, Today, All, Help\n"; print " where help will describe additional options\n"; print "--numeric: Display addresses numerically rather than symbolically and numerically\n"; print " (saves a nameserver address-to-name lookup).\n"; print "--debug : Debug Level - High, Med, Low or any #.\n"; print "--hostformat: Host Based Report Options - none [default], split, splitmail.\n"; #8.0 print "--hostlimit: Limit report to hostname - host1,host2.\n"; #8.0 print "--hostname: overwrites hostname\n"; print "--html_wrap : Default is 80.\n"; print "--version: Displays current version.\n"; print "--help: This message.\n"; print "--usage: Same as --help.\n"; print "* = Switch can be specified multiple times...\n\n"; exit (99); } ############################################################################ #END sub Usage ############################################################################# ############################################################################# #sub initprint # ############################################################################# sub initprint { return if $printing; my $OStitle; $OStitle = $OSname; $OStitle = "Solaris" if ($OSname eq "SunOS" && $release >= 2); if ($Config{'output'} eq "stdout") { #8.0 start with others? *OUTFILE = *STDOUT; } elsif ($Config{'output'} eq "file") { open(OUTFILE,">>" . $Config{'filename'}) or die "Can't open output file: $Config{'filename'} $!\n"; } else { #fixme mailto if (($Config{'hostformat'} eq "splitmail") || ($emailopen eq "")) { #Use mailer = in logwatch.conf to set options. Default should be "sendmail -t" #In theory this should be able to handle many different mailers. I might need to add #some filter code on $Config{'mailer'} to make it more robust. -mgt open(OUTFILE,"|$Config{'mailer'}") or die "Can't execute $Config{'mailer'}: $!\n"; my $mailto = $Config{"mailto_$Config{'hostname'}"}; $mailto = $Config{'mailto'} unless $mailto; for my $to (split(/ /, $mailto)) { print OUTFILE "To: $to\n"; } print OUTFILE "From: $Config{'mailfrom'}\n"; #If $Config{'subject'} exists lets use it. #This does not allow for variable expansion as the default below does -mgt if ($Config{'subject'}) { print OUTFILE "Subject: $Config{'subject'}\n"; } else { print OUTFILE "Subject: Logwatch for $Config{'hostname'} (${OStitle})\n"; } #Add headers to recognize automatically generated email print OUTFILE "Auto-Submitted: auto-generated\n"; print OUTFILE "Precedence: bulk\n"; #Add MIME $out_mime = "MIME-Version: 1.0\n"; #Config{encode} switch if ( $Config{'encode'} eq "base64" ) { $out_mime .= "Content-transfer-encoding: base64\n"; } else { $out_mime .= "Content-Transfer-Encoding: 7bit\n"; } #Config{output} html if ( $Config{'format'} eq "html" ) { $out_mime .= "Content-Type: text/html; charset=\"iso-8859-1\"\n\n"; } else { $out_mime .= "Content-Type: text/plain; charset=\"iso-8859-1\"\n\n"; } if ($Config{'hostformat'} eq "split") { #8.0 check hostlimit also? or ne none? print OUTFILE "Reporting on hosts: @hosts\n"; } $emailopen = 'y'; } #End if hostformat || emailopen } #End if printing/save/else $printing = 'y'; # simple parse of the dates my $simple_timematch = &TimeFilter(" %Y-%b-%d %Hh %Mm %Ss "); my @simple_range = split(/\|/, $simple_timematch); if ($#simple_range > 1) { # delete all array entries, except first and last splice(@simple_range, 1, $#simple_range-1); } for (my $range_index=0; $range_index<$#simple_range+1; $range_index++) { $simple_range[$range_index] =~ s/\.\.[hms]//g; $simple_range[$range_index] =~ s/\.//g; $simple_range[$range_index] =~ tr/--//s; $simple_range[$range_index] =~ s/ -|- //; $simple_range[$range_index] =~ tr/ //s; } my $print_range = join("/",@simple_range); $index_par++; if ( $Config{'format'} eq "html" ) { &output( $index_par, "LOGWATCH Summary" . (($Config{'hostformat'} ne "none") ? ": $Config{'hostname'}" : ""), "start"); &output( $index_par, " Logwatch Version: $Version ($VDate)\n", "line"); } else { &output( $index_par, "\n ################### Logwatch $Version ($VDate) #################### \n", "line"); } &output( $index_par, " Processing Initiated: " . localtime(time) . "\n", "line"); &output( $index_par, " Date Range Processed: $Config{'range'}\n", "line"); &output( $index_par, " $print_range\n", "line") if ($Config{'range'} ne 'all'); &output( $index_par, " Period is " . &GetPeriod() . ".\n", "line") if ($Config{'range'} ne 'all'); &output( $index_par, " Detail Level of Output: $Config{'detail'}\n", "line"); &output( $index_par, " Type of Output/Format: $Config{'output'} / $Config{'format'}\n", "line"); &output( $index_par, " Logfiles for Host: $Config{'hostname'}\n", "line"); if ( $Config{'hostlimit'} ) { &output( $index_par, " Hosts limited to: $Config{'hostlimit'}\n", "line"); } if ( $Config{'format'} eq "html" ) { &output( $index_par, "\n", "stop"); } else { &output( $index_par, "################################################################## \n", "line"); } } #################################################################### #END sub initprint #################################################################### ################################################################### #sub parselogs # ################################################################### sub parselogs { my $Service; #Load our ignore file order is [assume normal install] /etc/conf, /usr/share/logwatch/dist.conf and then default.conf -mgt my @IGNORE; if ( -e "$ConfigDir/conf/ignore.conf") { open( IGNORE, "$ConfigDir/conf/ignore.conf" ) or return undef; @IGNORE = grep {!/(^#|^\s+$)/} ; close IGNORE; } elsif ( -e "$BaseDir/dist.conf/ignore.conf") { open( IGNORE, "$BaseDir/dist.conf/ignore.conf" ) or return undef; @IGNORE = grep {!/(^#|^\s+$)/} ; close IGNORE; } elsif ( -e "$BaseDir/default.conf/ignore.conf") { open( IGNORE, "$BaseDir/default.conf/ignore.conf" ) or return undef; @IGNORE = grep {!/(^#|^\s+$)/} ; close IGNORE; } my @EnvList = (); # first sort alphabetically, and then based on DisplayOrder foreach $Service ( sort {$ServiceData{$a}{'displayorder'} <=> $ServiceData{$b}{'displayorder'} } (sort @ServiceList)) { my $Ignored = 0; $ENV{'PRINTING'} = $printing; if (defined $ServiceData{$Service}{'detail'}) { $ENV{'LOGWATCH_DETAIL_LEVEL'} = $ServiceData{$Service}{'detail'}; } else { $ENV{'LOGWATCH_DETAIL_LEVEL'} = $ENV{'LOGWATCH_GLOBAL_DETAIL'}; } @FileList = @{$ServiceData{$Service}{'logfiles'}}; my $FileText = ""; foreach $ThisFile (@FileList) { if (-s $TempDir . $ThisFile) { $FileText .= ( $TempDir . $ThisFile . " "); } } # remove the ENV entries set by previous service foreach my $Parm (@EnvList) { delete $ENV{$Parm}; } @EnvList = (); my $FilterText = " "; foreach (sort keys %{$ServiceData{$Service}}) { my $cmd = $_; if ($cmd =~ s/^\d+-\*//) { if (-f "$ConfigDir/scripts/shared/$cmd") { $FilterText .= ("$PerlVersion $ConfigDir/scripts/shared/$cmd '$ServiceData{$Service}{$_}' |" ); } elsif (-f "$BaseDir/scripts/shared/$cmd") { $FilterText .= ("$PerlVersion $BaseDir/scripts/shared/$cmd '$ServiceData{$Service}{$_}' |" ); } else { die "Cannot find shared script $cmd\n"; } } elsif ($cmd =~ s/^\$//) { $ENV{$cmd} = $ServiceData{$Service}{$_}; push @EnvList, $cmd; if ($Config{'debug'}>4) { print "export $cmd='$ServiceData{$Service}{$_}'\n"; } } } # set env variables LOGWATCH_mumble_LIST push @EnvList, 'LOGWATCH_LOGFILE_LIST'; push @EnvList, 'LOGWATCH_ARCHIVE_LIST'; $ENV{'LOGWATCH_LOGFILE_LIST'} = ''; $ENV{'LOGWATCH_ARCHIVE_LIST'} = ''; foreach my $LogGroup (@FileList) { foreach my $log (@{$LogFileData{$LogGroup}{'logfiles'}}) { $ENV{'LOGWATCH_LOGFILE_LIST'} .= $log . " "; } foreach my $archive (@{$LogFileData{$LogGroup}{'archives'}}) { $ENV{'LOGWATCH_ARCHIVE_LIST'} .= $archive . " "; } } if ($Config{'debug'}>4) { print "\nexport LOGWATCH_LOGFILE_LIST='$ENV{LOGWATCH_LOGFILE_LIST}'"; print "\nexport LOGWATCH_ARCHIVE_LIST='$ENV{LOGWATCH_ARCHIVE_LIST}'"; } # ECP - insert the host stripping now my $HostStrip = " "; if ($Config{'hostformat'} ne "none") { #8.0 ############################################### # onlyhost reads $ENV{'LOGWATCH_ONLY_HOSTNAME'} and uses it to try and match # based on $line =~ m/^... .. ..:..:.. $hostname\b/io ############################################### $HostStrip = "$PerlVersion $BaseDir/scripts/shared/onlyhost"; } my $ServiceExec = "$BaseDir/scripts/services/$Service"; if (-f "$ConfigDir/scripts/services/$Service") { $ServiceExec = "$ConfigDir/scripts/services/$Service"; } else { $ServiceExec = "$BaseDir/scripts/services/$Service"; } if (-f $ServiceExec ) { #If shell= was set in service.conf we will use it if ($ServiceData{$Service}{shell}) { my $shelltest = $ServiceData{$Service}{shell}; $shelltest =~ s/([\w\/]+).*/$1/; if (-e "$shelltest") { $FilterText .= "$ServiceData{$Service}{shell} $ServiceExec"; } else { die "Can't use $ServiceData{$Service}{shell} for $ServiceExec"; } } else { $FilterText .= "$PerlVersion $ServiceExec"; } #End if shell } else { die "Can't open: " . $ServiceExec; } my $Command = ''; if (! @FileList) { output(1, "\n Warning: LogFile of service $ServiceData{$Service}{title} is not defined.\n", "line"); } else { if ($FileList[0] eq 'none') { $Command = " $FilterText 2>&1 "; } elsif ($FileText) { if ($HostStrip ne " ") { $Command = " ( $Config{'pathtocat'} $FileText | $HostStrip | $FilterText) 2>&1 "; } else { $Command = " ( $Config{'pathtocat'} $FileText | $FilterText) 2>&1 "; } } } if ($Command) { if ($Config{'debug'}>4) { print "\nProcessing Service: " . $Service . "\n" . $Command . "\n"; } open (TESTFILE,$Command . " |"); my $ThisLine; my $has_output = 0; LINE: while (defined ($ThisLine = )) { next LINE if ((not $printing) and $ThisLine =~ /^\s*$/); IGNORE: for my $ignore_filter (@IGNORE) { chomp $ignore_filter; if ($ThisLine =~ m/$ignore_filter/) { $Ignored++; next LINE; } } &initprint(); if (($has_output == 0) and ($ServiceData{$Service}{'title'})) { $index_par++; &output($index_par, $ServiceData{$Service}{'title'}, "start" ); my $BeginVar; if ($ENV{'LOGWATCH_GLOBAL_DETAIL'} == $ENV{'LOGWATCH_DETAIL_LEVEL'}) { $BeginVar = "Begin"; } else { $BeginVar = "Begin (detail=" . $ENV{'LOGWATCH_DETAIL_LEVEL'} . ")"; } if ( $Config{'format'} eq "html" ) { #BODY #&output( $index_par, "\n

$ServiceData{$Service}{'title'}

\n", "header"); } else { &output( $index_par, "\n --------------------- $ServiceData{$Service}{'title'} $BeginVar ------------------------ \n\n", "line"); } $has_output = 1; } &output( $index_par, $ThisLine, "line"); } close (TESTFILE); if ($has_output and $ServiceData{$Service}{'title'}) { if ( $Config{'format'} eq "html" ) { if ( ($Ignored > 0) && ($Config{'supress_ignores'} == 0) ) { &output( $index_par, "\n $Ignored Ignored Lines\n", "header"); }; #&output( $index_par, "\n

$ServiceData{$Service}{'title'} End

\n", "header"); } else { if ( ($Ignored > 0) && ($Config{'supress_ignores'} == 0) ) { &output( $index_par, "\n $Ignored Ignored Lines\n", "line"); }; &output( $index_par, "\n ---------------------- $ServiceData{$Service}{'title'} End ------------------------- \n\n", "line"); } &output( $index_par, "\n", "stop"); } } } #HTML should be external to logwatch.pl -mgt #These are steps only needed for HTML output if ( $Config{'format'} eq "html" ) { #HEADER #Setup temp Variables to swap my %HTML_var; $HTML_var{Version} = "$Version"; $HTML_var{VDate} = "$VDate"; #open template this needs to allow directory override like the rest of the confs open(HEADER, "$Config{html_header}") || die "Can not open HTML Header at $Config{html_header}: $!\n"; my @header =
; close HEADER; #Expand variables... There must be a better way -mgt for my $header_line (@header) { $header_line =~ s/\$([\w\_\-\{\}\[\]]+)/$HTML_var{$1}/g; $out_head .= $header_line; } #FOOTER #open template this needs to allow directory override like the rest of the confs open(FOOTER, "$Config{html_footer}") || die "Can not open HTML Footer at $Config{html_header}: $!\n"; my @footer =