Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package logwatch for openSUSE:Factory checked in at 2026-10-13 17:48:50 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/logwatch (Old) and /work/SRC/openSUSE:Factory/.logwatch.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "logwatch" Tue Oct 13 17:48:50 2026 rev:58 rq:1384563 version:7.15 Changes: -------- --- /work/SRC/openSUSE:Factory/logwatch/logwatch.changes 2026-06-05 15:01:49.812103340 +0200 +++ /work/SRC/openSUSE:Factory/.logwatch.new.3698736/logwatch.changes 2026-10-13 17:49:01.851583828 +0200 @@ -1,0 +2,47 @@ +Tue Oct 13 06:59:21 UTC 2026 - ecsos <[email protected]> + +- Update to 7.15 + * [logwatch.cron,logwatch.service] Changing executable path to bin. + * Cherry pick updates from Sven Strickroth - MR #90 + * Fixes for new formats for Dovecot 2.4 - from Terry - Ticket #99 + * Exit if dnf5 not found - as per request from Andrew Myers - Ticket #98 + * [fail2ban] Additional correction to force setting of service variable. + * [rsyslogd] Ignore "epoll subsystem signaled EPOLLERR for stream" messages + * [clam-upddate] Ignore_Outdated now ignores "DNS record is older" messages + * [rsyslogd] handle updated not permmitted to talk to peer message; + Only add unhandled connection closed messages to generic hash + * [named] Ignore more key messages + * [lvm] Handle VDO pools + * [evtapplication] simplify Application Hang output + * [rsyslogd] Handle "cannot resolve hostname" + * [rsyslogd] Add rsyslogd_ignore_connection_closed_error_messages option to ignore more connnection closed error messages + * [systemd] Ignore reload requested from systemctl + * [system] Ignore Sending signal SIGUSR2 to process message + * [systemd] Ignore sys.module.fuse.device message + * [fail2ban] Filtering out prefix (date, service, PID) because prior git commit changes (for journalctl) + leaves no 'anchor' for perl expressions. + So the prefix gets assigned into first non-optional variable when using standard fail2ban logs (not journalctl). + * [logwatch] Using /usr/bin rather than /usr/sbin as target directory. Also removed crontabs as required package. + * [freeradius] Ignore "rlm_ldap: libldap vendor:" version message + * [sshd] Ignore connection resets during writes, per Martijn Pieters + * [systemd] Hide 'unmerged-bin' error if Detail level less than 10, based on report from Daniel + * [sshd] Allow for disconnects listed without reason, per Reio Remma + * [dovecot] Update due to dovecot 2.4 that uses "Login aborted", by Martijn Pieters + * [postfix] Corrected typo; submitted by Peter K. + * [pam_unix] Simplify regest for gdm session opened, support users with . in names + * named: Do not hide warning that current working directory is not writable + * named: Silence some informative messages + * [named] Update forwarded result NOERROR is not an error + * Update fail2ban parser to treat loglevel as optional. + * [logwatch.pl] [From merge request 77] Improve readability check for logfiles. + * [pureftpd] Filtering additional messages, and improving filter for cleartext. + * Merge /u/zany/logwatch/ branch fix-emerge-syncing into master + * Merge /u/utopiabound/logwatch/ branch master into master + * Fix usage of (?:) no capture groups + * Add emerge Syncing-repository ignore + * [logwatch.spec] Corrected old day-of-week comment. + * [exim] Account for reformatted authenticator failures +- modified sources + * ChangeLog + +------------------------------------------------------------------- Old: ---- logwatch-7.14.tar.gz New: ---- logwatch-7.15.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ logwatch.spec ++++++ --- /var/tmp/diff_new_pack.OP7Bdk/_old 2026-10-13 17:49:03.683660625 +0200 +++ /var/tmp/diff_new_pack.OP7Bdk/_new 2026-10-13 17:49:03.684660667 +0200 @@ -17,7 +17,7 @@ Name: logwatch -Version: 7.14 +Version: 7.15 Release: 0 Summary: Tool to analyze and report on system logs License: MIT ++++++ ChangeLog ++++++ --- /var/tmp/diff_new_pack.OP7Bdk/_old 2026-10-13 17:49:03.714661924 +0200 +++ /var/tmp/diff_new_pack.OP7Bdk/_new 2026-10-13 17:49:03.718662092 +0200 @@ -2,6 +2,46 @@ control logs (e.g. 'git log --oneline v1..v2'), as the Logwatch project does not release a change log themselves. *** +==== 7.15 ==== +885f3cd (tag: 7.15) Preparation for release 7.15 +5432382 [logwatch.cron,logwatch.service] Changing executable path to bin. +09c8f26 Cherry pick updates from Sven Strickroth - MR #90 +a8adbb7 Fixes for new formats for Dovecot 2.4 - from Terry - Ticket #99 +1338cd9 Exit if dnf5 not found - as per request from Andrew Myers - Ticket #98 +01cafd2 [fail2ban] Additional correction to force setting of service variable. +f87f461 [rsyslogd] Ignore "epoll subsystem signaled EPOLLERR for stream" messages +c3fe9fb [clam-upddate] Ignore_Outdated now ignores "DNS record is older" messages +bd8609b [rsyslogd] handle updated not permmitted to talk to peer message; Only add unhandled connection closed messages to generic hash +3feaa56 [named] Ignore more key messages +94990a0 [lvm] Handle VDO pools +53a3ba3 [evtapplication] simplify Application Hang output +2e175b8 [rsyslogd] Handle "cannot resolve hostname" +4fa809b [rsyslogd] Add rsyslogd_ignore_connection_closed_error_messages option to ignore more connnection closed error messages +491b44b [systemd] Ignore reload requested from systemctl +b42fb68 [system] Ignore Sending signal SIGUSR2 to process message +2a9b831 [systemd] Ignore sys.module.fuse.device message +e7308ee [fail2ban] Filtering out prefix (date, service, PID) because prior git commit changes (for journalctl) leaves no 'anchor' for perl expressions. So the prefix gets assigned into first non-optional variable when using standard fail2ban logs (not journalctl). +844d816 [logwatch] Using /usr/bin rather than /usr/sbin as target directory. Also removed crontabs as required package. +64b5d47 [freeradius] Ignore "rlm_ldap: libldap vendor:" version message +94e281a [sshd] Ignore connection resets during writes, per Martijn Pieters +9f970f5 [systemd] Hide 'unmerged-bin' error if Detail level less than 10, based on report from Daniel +7c9a4c8 [sshd] Allow for disconnects listed without reason, per Reio Remma +4f1a92f [dovecot] Update due to dovecot 2.4 that uses "Login aborted", by Martijn Pieters +d2e5509 [postfix] Corrected typo; submitted by Peter K. +66e0248 [pam_unix] Simplify regest for gdm session opened, support users with . in names +7c71e0f named: Do not hide warning that current working directory is not writable +6a26699 named: Silence some informative messages +0577480 [named] Update forwarded result NOERROR is not an error +646da22 Update fail2ban parser to treat loglevel as optional. +9fab253 [logwatch.pl] [From merge request 77] Improve readability check for logfiles. +e941c93 [pureftpd] Filtering additional messages, and improving filter for cleartext. +335f954 Merge /u/zany/logwatch/ branch fix-emerge-syncing into master +5185da4 Merge /u/utopiabound/logwatch/ branch master into master +8f9995b Fix usage of (?:) no capture groups +f6ebfc9 Add emerge Syncing-repository ignore +125b7f0 [logwatch.spec] Corrected old day-of-week comment. +7fdbc74 [exim] Account for reformatted authenticator failures + ==== 7.14 ==== 93cb38b (tag: 7.14) Preparation for release 7.14 787379b Merge /u/opoplawski/logwatch/ branch archives into master ++++++ logwatch-7.14.tar.gz -> logwatch-7.15.tar.gz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/logwatch-7.14/conf/services/rsyslogd.conf new/logwatch-7.15/conf/services/rsyslogd.conf --- old/logwatch-7.14/conf/services/rsyslogd.conf 2025-10-19 10:55:44.000000000 +0200 +++ new/logwatch-7.15/conf/services/rsyslogd.conf 2026-07-16 04:41:45.000000000 +0200 @@ -18,6 +18,9 @@ # If you want to ignore specific messagges, list them here separated by ;'s. # $rsyslogd_ignore_messages = unexpected GnuTLS error -53 - this could be caused by a broken connection. GnuTLS reports: Error in the push function. +# Ignore connection closed messages for specific errors, takes a regular expression +# $rsyslogd_ignore_connection_closed_error_messages = ^unexpected GnuTLS error -54$ + # Set a threshold for ignoring messages about remote servers closing the # connection, generally due to a reboot. # $rsyslogd_remote_closed_threshold = 1 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/logwatch-7.14/install_logwatch.sh new/logwatch-7.15/install_logwatch.sh --- old/logwatch-7.14/install_logwatch.sh 2025-10-19 10:55:44.000000000 +0200 +++ new/logwatch-7.15/install_logwatch.sh 2026-07-16 04:41:45.000000000 +0200 @@ -326,8 +326,8 @@ fi #Symlink -ln -f -s $BASEDIR/scripts/logwatch.pl /usr/sbin/logwatch -printf "Created symlink for /usr/sbin/logwatch \n" +ln -f -s $BASEDIR/scripts/logwatch.pl /usr/bin/logwatch +printf "Created symlink for /usr/bin/logwatch \n" #Cron or Systemd timer if [ $systemd -eq 1 ]; then diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/logwatch-7.14/logwatch.spec new/logwatch-7.15/logwatch.spec --- old/logwatch-7.14/logwatch.spec 2026-01-22 04:05:19.000000000 +0100 +++ new/logwatch-7.15/logwatch.spec 2026-07-22 05:47:57.000000000 +0200 @@ -1,13 +1,13 @@ Summary: Analyzes and Reports on system logs Name: logwatch -Version: 7.14 +Version: 7.15 Release: 1 License: MIT Group: Applications/System URL: https://sourceforge.net/projects/logwatch/ BuildArch: noarch Source0: https://sourceforge.net/projects/logwatch/files/%{name}-%{version}/%{name}-%{version}.tar.gz -Requires: perl,grep,crontabs,perl-HTML-Parser +Requires: perl,grep,perl-HTML-Parser BuildRoot: %{_tmppath}/%{name}-%{version}-%{release} %description @@ -68,12 +68,12 @@ install -m 0644 logwatch.8 %{buildroot}%{_mandir}/man8 rm -f %{buildroot}%{_sysconfdir}/cron.daily/logwatch \ - %{buildroot}%{_sbindir}/logwatch + %{buildroot}%{_bindir}/logwatch install -m 0755 -d %{buildroot}%{_sysconfdir}/cron.daily install -m 0755 scheduler/logwatch.cron %{buildroot}%{_sysconfdir}/cron.daily/0logwatch -install -m 0755 -d %{buildroot}%{_sbindir} -ln -s %{_datadir}/logwatch/scripts/logwatch.pl %{buildroot}%{_sbindir}/logwatch +install -m 0755 -d %{buildroot}%{_bindir} +ln -s %{_datadir}/logwatch/scripts/logwatch.pl %{buildroot}%{_bindir}/logwatch echo "###### REGULAR EXPRESSIONS IN THIS FILE WILL BE TRIMMED FROM REPORT OUTPUT #####" > %{buildroot}%{_sysconfdir}/logwatch/conf/ignore.conf echo "# Local configuration options go here (defaults are in %{_datadir}/logwatch/default.conf/logwatch.conf)" > %{buildroot}%{_sysconfdir}/logwatch/conf/logwatch.conf @@ -103,7 +103,7 @@ %dir %{_sysconfdir}/logwatch %dir %{_sysconfdir}/logwatch/* %dir %{_sysconfdir}/logwatch/*/* -%{_sbindir}/logwatch +%{_bindir}/logwatch %{_datadir}/logwatch %doc %{_mandir}/man*/* %config(noreplace) %{_sysconfdir}/logwatch/conf/*.conf @@ -112,10 +112,13 @@ %changelog +* Wed Jul 22 2026 Frank Crawford <[email protected]> 7.15 +- release 7.15 + * Thu Jan 22 2026 Frank Crawford <[email protected]> 7.14 - release 7.14 -* Tue Jun 22 2025 Bjorn <[email protected]> 7.13 +* Sun Jun 22 2025 Bjorn <[email protected]> 7.13 * Wed Jan 22 2025 Bjorn <[email protected]> 7.12 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/logwatch-7.14/scheduler/logwatch.cron new/logwatch-7.15/scheduler/logwatch.cron --- old/logwatch-7.14/scheduler/logwatch.cron 2019-01-19 08:00:22.000000000 +0100 +++ new/logwatch-7.15/scheduler/logwatch.cron 2026-07-22 05:40:02.000000000 +0200 @@ -1,7 +1,7 @@ #!/bin/sh #Set logwatch executable location -LOGWATCH_SCRIPT="/usr/sbin/logwatch" +LOGWATCH_SCRIPT="/usr/bin/logwatch" # Add options to the OPTIONS variable. Most options should be defined in # the file /etc/logwatch/conf/logwatch.conf, but some are only for the diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/logwatch-7.14/scheduler/logwatch.service new/logwatch-7.15/scheduler/logwatch.service --- old/logwatch-7.14/scheduler/logwatch.service 2020-01-04 06:39:32.000000000 +0100 +++ new/logwatch-7.15/scheduler/logwatch.service 2026-07-22 05:40:02.000000000 +0200 @@ -10,4 +10,4 @@ # This second EnvironmentFile is meant for system-specific # customization of variables, including overriding the defaults EnvironmentFile=-/etc/logwatch/conf/systemd.conf -ExecStart=/usr/sbin/logwatch $LOGWATCH_OPTIONS +ExecStart=/usr/bin/logwatch $LOGWATCH_OPTIONS diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/logwatch-7.14/scripts/logwatch.pl new/logwatch-7.15/scripts/logwatch.pl --- old/logwatch-7.14/scripts/logwatch.pl 2026-01-22 04:06:02.000000000 +0100 +++ new/logwatch-7.15/scripts/logwatch.pl 2026-07-22 05:48:33.000000000 +0200 @@ -10,8 +10,8 @@ ######################################################## # Specify version and build-date: -my $Version = '7.14'; -my $VDate = '01/22/26'; +my $Version = '7.15'; +my $VDate = '07/22/26'; ####################################################### # Logwatch was originally written by: @@ -815,12 +815,16 @@ next; } if (! -r $ThisFile) { - print "File $ThisFile is not readable. Check permissions."; - if ($> != 0) { - print " You are not running as superuser."; + # check again to ensure we do not have access due to ACL or similar methods as -r by default only checks permission bits + use filetest 'access'; + if (! -r $ThisFile) { + print "File $ThisFile is not readable. Check permissions."; + if ($> != 0) { + print " You are not running as superuser."; } - print "\n"; - next; + print "\n"; + next; + } } #FIXME - We have a bug report for filenames with spaces, can be caught here needs test -mgt $FileText .= ("'" . $ThisFile . "' "); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/logwatch-7.14/scripts/services/clam-update new/logwatch-7.15/scripts/services/clam-update --- old/logwatch-7.14/scripts/services/clam-update 2025-10-19 10:55:44.000000000 +0200 +++ new/logwatch-7.15/scripts/services/clam-update 2026-07-16 04:41:45.000000000 +0200 @@ -148,7 +148,7 @@ if ((my $Text) = ($ThisLine =~ /^ERROR: (.*)/)) { $Errors{$Text}++; } elsif (($Text) = ($ThisLine =~ /^WARNING: (.*)/)) { - if (! (($Text =~ /OUTDATED|Local version/) && + if (! (($Text =~ /OUTDATED|Local version|DNS record is older/) && $Ignore_Outdated)) { $Warnings{$Text}++; } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/logwatch-7.14/scripts/services/dnf5 new/logwatch-7.15/scripts/services/dnf5 --- old/logwatch-7.14/scripts/services/dnf5 2025-12-24 02:41:00.000000000 +0100 +++ new/logwatch-7.15/scripts/services/dnf5 2026-07-17 04:16:25.000000000 +0200 @@ -40,6 +40,11 @@ my $pathto_dnf5 = $ENV{'pathto_dnf5'} || '/usr/bin/dnf'; my $dnf5_uses_UTC = $ENV{'dnf5_uses_utc'} || 0; +if ( ! -f "$pathto_dnf5" ) { + print STDERR "\n\nDEBUG: Exiting DNF5 Filter - dnf5 not found at $pathto_dnf5\n" if $Debug >= 5; + exit(0); +} + if ( $Debug >= 5 ) { print STDERR "\nDEBUG: Inside dnf5 Filter \n"; print STDERR "DEBUG: Path to dnf: $pathto_dnf5\n"; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/logwatch-7.14/scripts/services/dovecot new/logwatch-7.15/scripts/services/dovecot --- old/logwatch-7.14/scripts/services/dovecot 2025-12-24 02:48:21.000000000 +0100 +++ new/logwatch-7.15/scripts/services/dovecot 2026-07-17 04:16:25.000000000 +0200 @@ -192,6 +192,7 @@ ($ThisLine =~ /auth-worker/) or ($ThisLine =~ /auth:.*: Connected to/) or ($ThisLine =~ /Disconnected: Connection closed(?! \(auth failed)/) or + ($ThisLine =~ /Authenticate LOGIN failed: Aborted/) or # is immediately followed by "Login aborted: Logged out" which is handled below ($ThisLine =~ /Info: Connection closed/) or ($ThisLine =~ /IMAP.*: Connection closed bytes/) or ($ThisLine =~ /IMAP.* failed with mbox file/) or @@ -225,8 +226,8 @@ $End = 0; # POP3 login - } elsif ( (($User, $Host) = ( $ThisLine =~ /^(?:$dovecottag )?pop3-login: Login: (.*?) \[(.*)\]/ ) ) or - (($User, $Host) = ( $ThisLine =~ /^(?:$dovecottag )?pop3-login: (?:Info: )?Login: user=\<(.*?)\>.*rip=(.*), lip=/ ) ) ) { + } elsif ( (($User, $Host) = ( $ThisLine =~ /^(?:$dovecottag )?pop3-login: (?:Login|Logged in): (.*?) \[(.*)\]/ ) ) or + (($User, $Host) = ( $ThisLine =~ /^(?:$dovecottag )?pop3-login: (?:Info: )?(?:Login|Logged in): user=\<(.*?)\>.*rip=(.*), lip=/ ) ) ) { if ($Host !~ /$IgnoreHost/) { $Host = hostName($Host); $Login{$User}{$Host}++; @@ -279,23 +280,37 @@ # # imap-login: # dovecot[123]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 7 secs): user=<user>, method=PLAIN, rip=1.2.3.4, lip=1.2.3.9, TLS: Connection closed, session=<xxxx> + # dovecot[123]: imap-login: Login aborted: Connection closed (auth failed, 1 attempts in 7 secs): user=<user>, method=PLAIN, rip=1.2.3.4, lip=1.2.3.9, TLS: Connection closed, session=<xxxx> # # imap-login aborted: # dovecot[123]: imap-login: Disconnected: Aborted login by logging out (auth failed, 1 attempts in 2 secs): user=<info>, method=PLAIN, rip=1.2.3.4, lip=1.2.3.9, TLS, session=<xxxx> + # dovecot[123]: imap-login: Login aborted: Aborted login by logging out (auth failed, 1 attempts in 2 secs): user=<info>, method=PLAIN, rip=1.2.3.4, lip=1.2.3.9, TLS, session=<xxxx> + # + # Post Dovecot 2.4 format changed. + # auth([email protected],000.000.000.000,sasl:login): passwd-file: Password mismatch + # auth([email protected],000.000.000.000,sasl:plain)<Praf3JlNkTIbffRG>: passwd-file: + # imap-login: Login aborted: Logged out (auth failed, 1 attempts in 4 secs) (auth_failed): user=<[email protected]>, method=PLAIN, rip=45.186.249.180, lip=000.000.000.000, TLS, session=<7ktqYcBNzGAtuvm0> + # imap-login: Login aborted: Connection closed (auth failed, 1 attempts in 2 secs) (auth_failed): user=<[email protected]>, method=PLAIN, rip=201.223.106.155, lip=000.000.000.000, TLS: Connection closed, session=<zEcJQMpNRIfJ32qb> + # imap-login: Login aborted: Inactivity (auth failed, 2 attempts in 178 secs) (auth_failed): user=<[email protected]>, method=PLAIN, rip=103.207.4.46, lip=000.000.000.000, TLS, session=<cAGahMpNTeNnzwQu> + # dovecot[123]: imap-login: Login aborted: Inactivity during authentication (client didn't finish SASL auth, 2 attempts in 180 secs) (auth_waiting_client): user=<info>, method=LOGIN, rip=1.2.3.4, lip=1.2.3.9, TLS, session=<xxxx> # } elsif (($User,$IP) = ( $ThisLine =~ /auth: (?:pam|passwd-file)\(([^,]+),([^,\)]+).*\): unknown user/ ) ) { $UnknownUsers{$User}{$IP}++; + } elsif (($User,$IP) = ( $ThisLine =~ /auth\(([^,]+),([^,]+),.+\).+(?:pam|passwd-file): unknown user/ ) ) { + $UnknownUsers{$User}{$IP}++; } elsif (($User,$IP) = ( $ThisLine =~ /auth: (?:pam|passwd-file)\(([^,]+),([^,\)]+).*\): Password mismatch/ ) ) { $AuthFail{$User}{$IP}++; - } elsif ( ($Host) = ($ThisLine =~ /Login aborted:.*no_auth_attempts.*rip=([^,]+).*/) ) { + } elsif (($User,$IP) = ( $ThisLine =~ /auth\(([^,]+),([^,]+),.+\).+(?:pam|passwd-file): Password mismatch/ ) ) { + $AuthFail{$User}{$IP}++; + } elsif ( ($Host) = ($ThisLine =~ /Login aborted:.*(?:no_auth_attempts|auth_aborted_by_client|auth_waiting_client).*rip=([^,]+).*/) ) { $Host = hostName($Host); $Aborted{$Host}++; - } elsif ( ($User, $IP) = ($ThisLine =~ /Disconnected: .* \(auth failed, .*\): user=<([^>]+)>,.*rip=([^,]+).*/) ) { + } elsif ( ($User, $IP) = ($ThisLine =~ /(?:Disconnected|Login aborted): .* \(auth[ _]failed, .*\): user=<([^>]+)>,.*rip=([^,]+).*/) ) { $AuthFail{$User}{$IP}++; - if ( ($Host) = ($ThisLine =~ /Aborted login.* rip=([0-9\.]+|[a-fA-F:0-9]+)/) ) { - $Host = hostName($Host); - $Aborted{$Host}++; - } + if ( ($Host) = ($ThisLine =~ /(?:Aborted login|Connection closed|Logged out|Inactivity).* rip=([0-9\.]+|[a-fA-F:0-9]+)/) ) { + $Host = hostName($Host); + $Aborted{$Host}++; + } # submission # submission(zeus)<307183><Rhh94lMzwfXAqCoC>: Successfully relayed message: from=<[email protected]>, size=1413, id=VaW1GXPwBmjvrwQAot0D+g, nrcpt=1, reply=`250 2.0.0 53M1RFgl307185 Message accepted for delivery': 1 Time(s) @@ -456,7 +471,10 @@ # added 'plain' for auth: and modified to deal with IPv6 addresses as well: # auth: plain(?,1.2.3.4): Request timed out waiting for client to continue authentication (150 secs): 1 Time(s) # auth: plain(?,dead:beef::1): Request timed out waiting for client to continue authentication (150 secs): 1 Time(s) - } elsif ( ($User,$IP) = ($ThisLine =~ /auth: (?:LOGIN|login|plain)\((.*),(\d+\.\d+\.\d+\.\d+|[a-fA-F:0-9]+)\): Request timed out waiting for client to continue authentication/) ) { + # auth(?,1.2.3.4,sasl:login): Request timed out waiting for client to continue authentication (150 secs): 1 Time(s) + # auth(?,dead:beef::1,sasl:login)<xxxxxx>: Request timed out waiting for client to continue authentication (150 secs): 1 Time(s) + } elsif ( ($User,$IP) = ($ThisLine =~ /auth(?:: (?:LOGIN|login|plain))?\((.*),(\d+\.\d+\.\d+\.\d+|[a-fA-F:0-9]+)(?:,.*)?\)(?:<.*>)?: Request timed out waiting for client to continue authentication/) ) { + $AuthTimedOut{$User}{$IP}++; # Invalid input at authentication @@ -472,7 +490,8 @@ $AuthDisconnectedWithPending{$Reason}++; # Disallowed usernmae characters - } elsif ( ($IP) = ($ThisLine =~ /auth: login\(.*,(\d+\.\d+\.\d+\.\d+)\): Username character disallowed by auth_username_chars: .* \(username: .*\)/) ) { + # auth(?,1.2.3.4,sasl:login): login: Username character disallowed by auth_username_chars: 0xec (username: <some random unicode character>) + } elsif ( ($IP) = ($ThisLine =~ /auth(?:: (?:LOGIN|login|plain))?\(.*,(\d+\.\d+\.\d+\.\d+|[a-fA-F:0-9]+)(?:,.*)?\): (?:(?:LOGIN|login|plain): )?Username character disallowed by auth_username_chars: .* \(username: .*\)/) ) { $AuthUsernameChars{$IP}++; # Maximum number of connections exceeded diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/logwatch-7.14/scripts/services/emerge new/logwatch-7.15/scripts/services/emerge --- old/logwatch-7.14/scripts/services/emerge 2025-10-19 10:55:44.000000000 +0200 +++ new/logwatch-7.15/scripts/services/emerge 2026-03-16 01:44:00.000000000 +0100 @@ -70,6 +70,7 @@ ($ThisLine =~ /terminating/) or ($ThisLine =~ /Compiling/) or ($ThisLine =~ /=== sync/) or + ($ThisLine =~ /Syncing repository/i) or ($ThisLine =~ /Starting rsync with/i) or ($ThisLine =~ /Merging/) or ($ThisLine =~ /Unmerging./) or diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/logwatch-7.14/scripts/services/evtapplication new/logwatch-7.15/scripts/services/evtapplication --- old/logwatch-7.14/scripts/services/evtapplication 2025-10-19 10:55:44.000000000 +0200 +++ new/logwatch-7.15/scripts/services/evtapplication 2026-07-16 04:41:45.000000000 +0200 @@ -76,9 +76,9 @@ next; } } elsif ($Application eq "Application Hang") { - if (my ($exe, $exever, $msg) = - ($ExpandedString =~ /The program (.*) version (\S+) (.*) Process ID:/)) { - $Applications{$Application}->{"$Hostname: The program $exe version $exever $msg"}++; + if (my ($exe, $exever) = + ($ExpandedString =~ /The program (.*) version (\S+)/)) { + $Applications{$Application}->{"$Hostname: program $exe version $exever"}++; next; } else { print "Application Hang: Cannot parse $ExpandedString\n"; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/logwatch-7.14/scripts/services/exim new/logwatch-7.15/scripts/services/exim --- old/logwatch-7.14/scripts/services/exim 2025-10-19 10:55:44.000000000 +0200 +++ new/logwatch-7.15/scripts/services/exim 2026-03-16 01:44:00.000000000 +0100 @@ -672,7 +672,7 @@ $SmtpProblemHosts{$key}++; $SmtpConnection{$bb}++; } - elsif ( $ThisOne =~ /authenticator failed for (?:\S+ |)\([^)]*\) \[($IPAddress)\](?::\d+ |)(?:I=\[$IPAddress\]:\d+|): ([^(]*)/ ) { + elsif ( $ThisOne =~ /authenticator failed for (?:\S+ |H=|)\(?[^)]*\)? \[($IPAddress)\](?::\d+ |)(?:I=\[$IPAddress\]:\d+|): ([^(]*)/ ) { my $key = $1; $bb = $2; $bb =~ s/\s+$//; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/logwatch-7.14/scripts/services/fail2ban new/logwatch-7.15/scripts/services/fail2ban --- old/logwatch-7.14/scripts/services/fail2ban 2025-10-19 10:55:44.000000000 +0200 +++ new/logwatch-7.15/scripts/services/fail2ban 2026-07-16 04:41:45.000000000 +0200 @@ -68,30 +68,32 @@ print STDERR "DEBUG($DebugCounter): $ThisLine"; $DebugCounter++; } + $ThisLine =~ s/^\d{4}-\d\d-\d\d \d\d:\d\d:\d\d,\d{3} fail2ban\.\w+\s+\[\d+\d\]://; + chomp($ThisLine); if ( ($ThisLine =~ /..,... DEBUG: /) or ($ThisLine =~ /..,... \S*\s*: DEBUG /) or # syntax of 0.7.? fail2ban ($ThisLine =~ /..,... INFO: (Fail2Ban v.* is running|Exiting|Enabled sections:)/) or - ($ThisLine =~ /INFO\s+Log rotation detected for/) or - ($ThisLine =~ /INFO\s+Jail.+(?:stopped|started|uses )/) or - ($ThisLine =~ /INFO\s+Changed logging target to/) or - ($ThisLine =~ /INFO\s+Creating new jail/) or - ($ThisLine =~ /INFO\s+(Set |Socket|Gamin|Created|Added|Using|Connected to |rollover performed)/) or # syntax of 0.7.? fail2ban + ($ThisLine =~ /(?:INFO\s+)?Log rotation detected for/) or + ($ThisLine =~ /(?:INFO\s+)?Jail.+(?:stopped|started|uses )/) or + ($ThisLine =~ /(?:INFO\s+)?Changed logging target to/) or + ($ThisLine =~ /(?:INFO\s+)?Creating new jail/) or + ($ThisLine =~ /(?:INFO\s+)?(Set |Socket|Gamin|Created|Added|Using|Connected to |rollover performed)/) or # syntax of 0.7.? fail2ban ($ThisLine =~ /..,... WARNING: Verbose level is /) or ($ThisLine =~ /..,... WARNING: Restoring firewall rules/) or - ($ThisLine =~ /WARNING Determined IP using DNS Lookup/) or - ($ThisLine =~ /INFO\s+Initiated '.*' backend/) or - ($ThisLine =~ /INFO\s+(Added logfile = .*|Set maxRetry = \d+|Set findtime = \d+|Set banTime = \d+)/) or + ($ThisLine =~ /(?:WARNING )?Determined IP using DNS Lookup/) or + ($ThisLine =~ /(?:INFO\s+)?Initiated '.*' backend/) or + ($ThisLine =~ /(?:INFO\s+)?(Added logfile = .*|Set maxRetry = \d+|Set findtime = \d+|Set banTime = \d+)/) or ($ThisLine =~ /Unable to find a corresponding IP address for .*: \[Errno -2\] Name or service not known/) ) { if ( $Debug >= 6 ) { print STDERR "DEBUG($DebugCounter): line ignored\n"; } - } elsif ( ($Service,$Action,$Host) = ($ThisLine =~ m/NOTICE:?\s+\[?(.*?)[]:]?\s(Restore Ban)[^\.]* (\S+)/)) { + } elsif ( ($Service,$Action,$Host) = ($ThisLine =~ m/(?:NOTICE:?\s+)?\[(.*?)[]:]\s(Restore Ban)[^\.]* (\S+)/)) { $ServicesBans{$Service}{$Host}{'ReBan'}++; $ServicesBans{$Service}{"(all)"}{'ReBan'}++; - } elsif ( ($Service,$Increase,$Action,$Host) = ($ThisLine =~ m/(?:WARNING|NOTICE):?\s+\[?(.*?)[]:]?\s(Increase\s)?(Ban|Unban)[^\.]* (\S+)/)) { + } elsif ( ($Service,$Increase,$Action,$Host) = ($ThisLine =~ m/(?:WARNING:?\s+|NOTICE:?\s+)?\[(.*?)[]:]\s(Increase\s)?(Ban|Unban)[^\.]* (\S+)/)) { if ( $Increase ) { $Service .= " increase" } @@ -109,32 +111,32 @@ $ServicesBans{$Service}{$Host}{$Action}++; $ServicesBans{$Service}{"(all)"}{$Action}++; } - } elsif ( ($Service,$Host,$NumFailures) = ($ThisLine =~ m/INFO: (\S+): (.+) has (\d+) login failure\(s\). Banned./)) { + } elsif ( ($Service,$Host,$NumFailures) = ($ThisLine =~ m/(?:INFO: )?(\S+): (.+) has (\d+) login failure\(s\). Banned./)) { if ($Debug >= 4) { print STDERR "DEBUG: Found host $Host trying to access $Service - failed $NumFailures times\n"; } push @{$ServicesBans{$Service}{$Host}{'Failures'}}, $NumFailures; - } elsif ( ($Service,$Host) = ($ThisLine =~ m/ ERROR:\s(.*):\s(\S+)\salready in ban list/)) { + } elsif ( ($Service,$Host) = ($ThisLine =~ m/(?: ERROR:\s)?(.*):\s(\S+)\salready in ban list/)) { $ServicesBans{$Service}{$Host}{'AlreadyInTheList'}++; - } elsif ( ($Service,$Host) = ($ThisLine =~ m/(?:INFO|WARNING|NOTICE)\s*\[(.*)\]\s*(\S+)\s*already banned/)) { + } elsif ( ($Service,$Host) = ($ThisLine =~ m/(?:INFO|WARNING|NOTICE)?\s*\[(.*)\]\s*(\S+)\s*already banned/)) { $ServicesBans{$Service}{$Host}{'AlreadyInTheList'}++; - } elsif ( ($Service,$Message) = ($ThisLine =~ m/WARNING\s*\[(.*)\].* (latency problem|timing issue)/)) { + } elsif ( ($Service,$Message) = ($ThisLine =~ m/(?:WARNING\s*)?\[(.*)\].* (latency problem|timing issue)/)) { next if $Service =~ /$IgnoreLatency/; $LatencyIssues{$Service}++ if $Message eq "latency problem"; - } elsif ( ($Service,$Host) = ($ThisLine =~ m/ WARNING:\s(.*):\sReBan (\S+)/)) { + } elsif ( ($Service,$Host) = ($ThisLine =~ m/(?: WARNING:\s)?(.*):\sReBan (\S+)/)) { $ServicesBans{$Service}{$Host}{'ReBan'}++; - } elsif ($ThisLine =~ / ERROR:?\s*(Execution of command )?\'?iptables/) { + } elsif ($ThisLine =~ /(?: ERROR:?\s*)?(Execution of command )?\'?iptables/) { push @IptablesErrors, "$ThisLine\n"; - } elsif ($ThisLine =~ /ERROR.*returned \d+$/) { + } elsif ($ThisLine =~ /(?:ERROR)?.*returned \d+$/) { push @ActionErrors, "$ThisLine\n"; } elsif (($ThisLine =~ /..,... WARNING: \#\S+ reinitialization of firewalls/) or - ($ThisLine =~ / ERROR\s*Invariant check failed. Trying to restore a sane environment/)) { + ($ThisLine =~ /(?: ERROR\s*)?Invariant check failed. Trying to restore a sane environment/)) { $ReInitializations++; } elsif ($ThisLine =~ /..,... WARNING: is not a valid IP address/) { # just ignore - this will be fixed within fail2ban and is harmless warning - } elsif ( ($Service,$Host) = ($ThisLine =~ /INFO\s+\[(.*)\] Found (\S+)/)) { + } elsif ( ($Service,$Host) = ($ThisLine =~ /(?:INFO\s+)?\[(.*)\] Found (\S+)/)) { $ServicesFound{$Service}{$Host}++; - } elsif ( ($Service,$Host) = ($ThisLine =~ /INFO\s+\[(.*)\] Ignore (\S+)/)) { + } elsif ( ($Service,$Host) = ($ThisLine =~ /(?:INFO\s+)?\[(.*)\] Ignore (\S+)/)) { $ServicesIgnored{$Service}{$Host}++; # Generic messages } elsif ( ($Message) = ($ThisLine =~ / ERROR (.*)$/)) { diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/logwatch-7.14/scripts/services/freeradius new/logwatch-7.15/scripts/services/freeradius --- old/logwatch-7.14/scripts/services/freeradius 2025-10-19 10:55:44.000000000 +0200 +++ new/logwatch-7.15/scripts/services/freeradius 2026-07-16 04:41:45.000000000 +0200 @@ -81,6 +81,7 @@ ( $ThisLine =~ /^(?:Info: )?Received HUP signal/ ) || ( $ThisLine =~ /^(?:Info: )? ?Module: Reloaded module/ ) || ( $ThisLine =~ /^(?:Info: )?Signalled to terminate/ ) || + ( $ThisLine =~ /^rlm_ldap: libldap vendor:/ ) || # TD: # Skipping contents of 'if' as it is always 'false' -- /etc/raddb/sites-enabled/inner-tunnel # This is a standard config item ( $ThisLine =~ /^(?:Info: )? *# Skipping contents of 'if' as it is always 'false' -- .*inner-tunnel/ ) || diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/logwatch-7.14/scripts/services/lvm new/logwatch-7.15/scripts/services/lvm --- old/logwatch-7.14/scripts/services/lvm 2025-10-19 10:55:44.000000000 +0200 +++ new/logwatch-7.15/scripts/services/lvm 2026-07-16 04:41:45.000000000 +0200 @@ -53,6 +53,8 @@ or $ThisLine =~ /WARNING: lvmetad is being updated, retrying/ # This happens on shutdown or $ThisLine =~ /dmeventd detected break while being idle for 0 second\(s\), exiting/ + or $ThisLine =~ /dmeventd detected exit on file .*, unregistering all monitored devices/ + or $ThisLine =~ /dmeventd received break, scheduling exit/ # This happens when dmeventd autostarted or $ThisLine =~ /dmeventd ready for processing\.$/ or $ThisLine =~ /dmeventd shutting down\.$/ @@ -61,15 +63,15 @@ or $ThisLine =~ /Logical volume .* successfully resized/ ) { # Ignore - } elsif ($ThisLine =~ /^(?:WARNING: )?Thin (\S+) is now (\d+(\.\d+)?)% full/) { + } elsif ($ThisLine =~ /^(?:WARNING: )?(\S+ pool \S+)(?: data)? is now (\d+(\.\d+)?)% full/) { $PoolUsed{$1} = $2 if $2 >= $PoolThreshold; - } elsif ($ThisLine =~ /^(?:WARNING: )?Thin metadata (\S+) is now (\d+(\.\d+)?)% full/) { + } elsif ($ThisLine =~ /^(?:WARNING: )?(\S+ metadata \S+) is now (\d+(\.\d+)?)% full/) { $PoolMetadataUsed{$1} = $2 if $2 >= $PoolMetadataThreshold; - } elsif ($ThisLine =~ /^Monitoring thin pool (\S+)\./) { + } elsif ($ThisLine =~ /^Monitoring (.* pool \S+)\./) { $MonitoringOn{$1}++; } elsif ($ThisLine =~ /^Monitoring snapshot (\S+)\./) { $MonitoringSnapshot{$1}++; - } elsif ($ThisLine =~ /^No longer monitoring thin pool (\S+)\./) { + } elsif ($ThisLine =~ /^No longer monitoring (\S+ pool \S+)\./) { $MonitoringOff{$1}++; } elsif ($ThisLine =~ /^No longer monitoring snapshot (\S+)\./) { $MonitoringSnapshotOff{$1}++; @@ -89,7 +91,7 @@ } if (keys %PoolUsed) { - print "Thin Pool Usage:\n"; + print "Pool Usage:\n"; foreach my $Pool (sort {$a cmp $b} keys %PoolUsed) { print " $Pool: $PoolUsed{$Pool}% full\n"; } @@ -97,7 +99,7 @@ } if (keys %PoolMetadataUsed) { - print "Thin Pool Metadata Usage:\n"; + print "Pool Metadata Usage:\n"; foreach my $Pool (sort {$a cmp $b} keys %PoolMetadataUsed) { print " $Pool: $PoolMetadataUsed{$Pool}% full\n"; } @@ -122,7 +124,7 @@ if (keys %Active and $Detail) { print "LVM active:\n"; - foreach my $VG (sort {$a cmp $b} keys %MonitoringOn) { + foreach my $VG (sort {$a cmp $b} keys %Active) { print " $VG: $Active{$VG} logical volume(s)\n"; } print "\n"; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/logwatch-7.14/scripts/services/named new/logwatch-7.15/scripts/services/named --- old/logwatch-7.14/scripts/services/named 2025-10-19 10:55:44.000000000 +0200 +++ new/logwatch-7.15/scripts/services/named 2026-07-16 04:41:45.000000000 +0200 @@ -112,6 +112,7 @@ ($ThisLine =~ /bad referral/) or ($ThisLine =~ /prerequisite not satisfied/) or ($ThisLine =~ /(rcvd|Sent) NOTIFY/) or + ($ThisLine =~ /sending notify to/) or ($ThisLine =~ /ns_resp: TCP truncated/) or ($ThisLine =~ /No possible A RRs/) or ($ThisLine =~ /points to a CNAME/) or @@ -123,10 +124,10 @@ ($ThisLine =~ /recvfrom: No route to host/) or # Be sure to catch: transfer of 'zone' from IP#53: failed to connect: timed out # not exact just triggers a full transfer - ($ThisLine =~ /transfer of .*: (:?IXFR|AXFR(:?|-style IXFR) (:?started|ended)|connected using|failed while receiving responses: not exact)/) or + ($ThisLine =~ /transfer of .*: (?:IXFR|AXFR(?:|-style IXFR) (?:started|ended)|connected using|failed while receiving responses: not exact)/) or # This will generate another error that we will catch ($ThisLine =~ /transfer of .*: resetting/) or - ($ThisLine =~ /Transfer status: (:?success|up to date)/) or + ($ThisLine =~ /Transfer status: (?:success|up to date)/) or ($ThisLine =~ /using \d+ CPU/) or ($ThisLine =~ /loading configuration/) or ($ThisLine =~ /command channel listening/) or @@ -183,7 +184,7 @@ ($ThisLine =~ /success resolving '.*' \(in '.*'?\) after disabling EDNS/) or ($ThisLine =~ /success resolving '.*' after disabling qname minimization due to 'failure'/) or ($ThisLine =~ /success resolving '.*' after disabling qname minimization due to 'ncache nxdomain'/) or - ($ThisLine =~ /the working directory is not writable/) or + ($ThisLine =~ /the working directory is now/) or ($ThisLine =~ /using default UDP\/IPv[46] port range: \[[0-9]*, [0-9]*\]/) or ($ThisLine =~ /adjusted limit on open files from [0-9]* to [0-9]*/) or ($ThisLine =~ /using up to [0-9]* sockets/) or @@ -236,10 +237,12 @@ ($ThisLine =~ /----------------------------------------------------/) or ($ThisLine =~ /^[^ ]+ algorithms: /) or ($ThisLine =~ /^TKEY mode \d+ support /) or + ($ThisLine =~ /Fetching .* from key repository/) or ($ThisLine =~ /New key .* observed for zone/) or ($ThisLine =~ /next key event: /) or ($ThisLine =~ /reconfiguring zone keys/) or ($ThisLine =~ /using built-in DLV key/) or + ($ThisLine =~ /(?:DNSKEY|key) .* is now (?:active|published)/) or ($ThisLine =~ /trust-anchor-telemetry/) or ($ThisLine =~ /^adb: grow_entries /) or # ($ThisLine =~ /reading built-in trusted keys from file/) or @@ -357,7 +360,7 @@ } elsif ( ($Rhost, $Ldom) = ($ThisLine =~ /client ([\d\.]+)#\d+: update forwarding '(.*)' denied/)) { $UpdateForwardingDenied{"$Rhost ($Ldom)"}++; } elsif ( ($Zone, $Master, $Reason) = ($ThisLine =~ /zone (.*): forwarded dynamic update: master (.*)#\d+ returned: (.*)/)) { - $UpdateForwardingDenied{"$Zone ($Master) $Reason"}++; + $UpdateForwardingDenied{"$Zone ($Master) $Reason"}++ if $Reason ne "NOERROR"; } elsif ( ($Zone) = ($ThisLine =~ /zone '([0-9a-zA-Z.-]+)' allows updates by IP address, which is insecure/)) { $InsecUpdate{$Zone}++; } elsif ( ($Zone) = ($ThisLine =~ /zone ([0-9a-zA-Z.\/-]+): journal rollforward failed: journal out of sync with zone/)) { @@ -434,7 +437,7 @@ $LoopDetected{$Entry}++; } elsif (($Hint) = ($ThisLine =~ /checkhints: (.*)/) ) { $Hints{$Hint}++; - } elsif (($Response,$Net,$Zone) = ($ThisLine =~/limit(:?ing)? (.+) responses to (\S+)(?: for (.+) \()?/)) { + } elsif (($Response,$Net,$Zone) = ($ThisLine =~/limit(?:ing)? (.+) responses to (\S+)(?: for (.+) \()?/)) { $Zone = "None" unless defined($Zone); $Limit{$Zone}{$Response}{$Net}++ if $Detail; } elsif (($Client,$Response,$Net,$Zone) = ($ThisLine =~/client ([^#]+)(?:#\d+)? \(.*\): (?:view \w+: )?\s*rate limit drop (.+) response to (\S+)(?: for (\S+))?/)) { diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/logwatch-7.14/scripts/services/nut new/logwatch-7.15/scripts/services/nut --- old/logwatch-7.14/scripts/services/nut 2025-10-19 10:55:44.000000000 +0200 +++ new/logwatch-7.15/scripts/services/nut 2026-03-16 01:44:00.000000000 +0100 @@ -100,7 +100,7 @@ or $ThisLine =~ /^upssched: (?:Cancelling|New) timer:/ or $ThisLine =~ /^upssched: Timer daemon started/ or $ThisLine =~ /^upssched: Timer queue empty/ - or $ThisLine =~ /^snmp-ups: \[(\S+)\] snmp_ups_walk: data (:?resumed|stale)/ + or $ThisLine =~ /^snmp-ups: \[(\S+)\] snmp_ups_walk: data (?:resumed|stale)/ or $ThisLine =~ /^UPS: No longer on battery power/ # Should get a particular ups on battery power message or $ThisLine =~ /^UPS: On battery power in response to an input power problem/ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/logwatch-7.14/scripts/services/omsa new/logwatch-7.15/scripts/services/omsa --- old/logwatch-7.14/scripts/services/omsa 2025-10-19 10:55:44.000000000 +0200 +++ new/logwatch-7.15/scripts/services/omsa 2026-03-16 01:44:00.000000000 +0100 @@ -60,7 +60,7 @@ next if (($Message =~ /^Controller.* event log: Controller operating temperature within normal range/) and ($Detail < 5)); next if (($Message =~ /^Controller.* event log: (Board Revision|Controller hardware revision ID)/) and ($Detail < 10)); next if (($Message =~ /^Controller.* event log: Current capacity of the battery is above threshold/) and ($Detail < 5)); - next if (($Message =~ /^Controller.* event log: Enclosure .* (:?communication restored|discovered)/) and ($Detail < 10)); + next if (($Message =~ /^Controller.* event log: Enclosure .* (?:communication restored|discovered)/) and ($Detail < 10)); next if (($Message =~ /^Controller.* event log: Firmware initialization started/) and ($Detail < 10)); next if (($Message =~ /^Controller.* event log: Host driver is loaded and operational/) and ($Detail < 5)); next if (($Message =~ /^Controller.* event log: Inserted:/) and ($Detail < 5)); @@ -68,7 +68,7 @@ next if (($Message =~ /^Controller.* event log: Package version/) and ($Detail < 10)); next if (($Message =~ /^Controller.* event log: Shutdown command received from host/) and ($Detail < 1)); next if (($Message =~ /^Controller.* event log: Time established as/) and ($Detail < 10)); - next if (($Message =~ /^Controller.* event log: Unexpected sense: Encl PD .* CDB: 12 00 00 00 (:?04|20) 00, Sense: 5\/24\/00/) and ($IgnoreNonCertifiedDrives)); + next if (($Message =~ /^Controller.* event log: Unexpected sense: Encl PD .* CDB: 12 00 00 00 (?:04|20) 00, Sense: 5\/24\/00/) and ($IgnoreNonCertifiedDrives)); next if (($Message =~ /^Controller.* event log: Unexpected sense: PD .* CDB: 12 01 dc 01 1d 00, Sense: (4\/cf|5\/24)\/00/) and ($IgnoreNonCertifiedDrives)); next if (($Message =~ /Disk .* is not supplied by an authorized hardware provider/) and ($IgnoreNonCertifiedDrives)); next if (($Message =~ /Patrol Read .*(started|stopped|resumed|completed)/) and ($Detail < 5)); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/logwatch-7.14/scripts/services/pam_unix new/logwatch-7.15/scripts/services/pam_unix --- old/logwatch-7.14/scripts/services/pam_unix 2025-10-19 10:55:44.000000000 +0200 +++ new/logwatch-7.15/scripts/services/pam_unix 2026-07-16 04:41:45.000000000 +0200 @@ -155,7 +155,7 @@ ($Detail >= 5) && $data{$service}{'Password changed'}{$line}++; } } elsif (grep $_ eq $service, qw/gdm gdm-password gdm-smartcard gdm-welcome gdm-launch-environment kde kdm kcheckpass xdm imap dovecot cups/) { - if ($line =~ s/^session opened for user (.+) by (?:\(unknown\)|\w+)?\(uid=\d+\)/$1/) { + if ($line =~ s/^session opened for user (.+) by \S*\(uid=\d+\)/$1/) { ($Detail >= 5) && $data{$service}{'Sessions Opened'}{$line}++; } elsif ($line =~ s/^User info message: (.*)/$1/) { ($Detail >= 8) && $data{$service}{'User Info Message'}{$line}++; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/logwatch-7.14/scripts/services/postfix new/logwatch-7.15/scripts/services/postfix --- old/logwatch-7.14/scripts/services/postfix 2025-12-24 02:41:00.000000000 +0100 +++ new/logwatch-7.15/scripts/services/postfix 2026-07-16 04:41:45.000000000 +0200 @@ -5324,7 +5324,7 @@ end_section_group ($S, 'postfixstate'); begin_section_group ($S, 'backwardscompatible', "\n"); - add_section ($S, 'backwardscompatible', 1, 'd', 'Running in backwards compatibile mode'); + add_section ($S, 'backwardscompatible', 1, 'd', 'Running in backwards compatible mode'); end_section_group ($S, 'backwardscompatible'); if ($Opts{'debug'} & Logreporters::D_SECT) { diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/logwatch-7.14/scripts/services/pureftpd new/logwatch-7.15/scripts/services/pureftpd --- old/logwatch-7.14/scripts/services/pureftpd 2025-10-19 10:55:44.000000000 +0200 +++ new/logwatch-7.15/scripts/services/pureftpd 2026-03-16 01:44:00.000000000 +0100 @@ -58,12 +58,14 @@ if ( ( $ThisLine =~ /last message repeated/ ) or ( $ThisLine =~ /Timeout/) or + ( $ThisLine =~ /SNI: /) or + ( $ThisLine =~ /Anonymous user logged in/) or ( $ThisLine =~ /Can't change directory/) or ( $ThisLine =~ /Can't create directory: File exists/) or ( $ThisLine =~ /File successfully renamed or moved/) or ( $ThisLine =~ /This is a private system - No anonymous login/) or ( $ThisLine =~ /Authentication failed for user/) or - ( $ThisLine =~ /Sorry, cleartext sessions and weak ciphers not accepted on this server/) or + ( $ThisLine =~ /cleartext sessions and weak ciphers are not accepted on this server/) or ( $ThisLine =~ /TLS: Enabled/) or ( $ThisLine =~ /Transfer aborted/) or ( $ThisLine =~ /pure-ftpd startup( |) succeeded/) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/logwatch-7.14/scripts/services/rsyslogd new/logwatch-7.15/scripts/services/rsyslogd --- old/logwatch-7.14/scripts/services/rsyslogd 2025-10-19 10:55:44.000000000 +0200 +++ new/logwatch-7.15/scripts/services/rsyslogd 2026-07-16 04:41:45.000000000 +0200 @@ -33,6 +33,10 @@ $IgnoreActions{$action} = 1; } } +my $IgnoreClosedErrorMessages = '^unexpected GnuTLS error -54$'; +if (defined($ENV{'rsyslogd_ignore_connection_closed_error_messages'})) { + $IgnoreClosedErrorMessages = $ENV{'rsyslogd_ignore_connection_closed_error_messages'}; +} my %IgnoreMessages; if (defined($ENV{'rsyslogd_ignore_messages'})) { foreach my $message (split(";",$ENV{'rsyslogd_ignore_messages'})) { @@ -61,6 +65,7 @@ my %ActionResumed; my %ActionSuspended; my %CannotConnect; +my %CannotResolve; my %ClosedError; my %DaemonActions; my %InvalidCertificate; @@ -100,6 +105,9 @@ elsif (($Host, $Reason) = $ThisLine =~ /cannot connect to (.+): (.+) \[/) { $CannotConnect{"$Host ($Reason)"}++; } + elsif (($Host, $Reason) = $ThisLine =~ /cannot resolve hostname '(.+)': (.+) \[/) { + $CannotResolve{"$Host ($Reason)"}++; + } # These should also generate closed connection messages, but record so we can ignore normal events elsif( $ThisLine =~ /(TCPSendBuf error .*), destruct TCP Connection to/ or @@ -111,8 +119,8 @@ ) { $LastError = $1; } - elsif (($Host) = $ThisLine =~ /^netstream session \S+ from (\S+) will be closed due to error/) { - $ClosedError{$LastError}{"$Host"}++ if $LastError !~ /unexpected GnuTLS error -54/; + elsif (($Host) = $ThisLine =~ /^netstream session \S+ from (\S+?)(?::\d+)? will be closed due to error/) { + $ClosedError{$LastError}{"$Host"}++ if $LastError and $LastError !~ /$IgnoreClosedErrorMessages/i; } elsif (($Host) = $ThisLine =~ /^omfwd: remote server at (.+) seems to have closed connection/) { $RemoteClosed{"$Host"}++; @@ -124,9 +132,10 @@ # paired with rate-limiting count message above $ThisLine =~ /begin to drop messages due to rate-limiting/ or # paired with other errors + $ThisLine =~ /^epoll subsystem signaled EPOLLERR for stream / or $ThisLine =~ /^GnuTLS error: Error in the push function/ or - # More detail for this in the invalid cert info line above - $ThisLine =~ /^not permitted to talk to peer, certificate invalid:/ or + # More detail for this in the invalid cert info line below + $ThisLine =~ /^not permitted to talk to peer.*, certificate invalid:/ or $ThisLine =~ /^rsyslogd\'s (groupid|userid) changed to/ or $ThisLine =~ /^imjournal: journal files changed, reloading/ or $ThisLine =~ /^imjournal: journal reloaded/ or @@ -169,6 +178,14 @@ } print "\n"; } + +if (keys %CannotResolve) { + print "Cannot resolve hostname:\n"; + foreach my $Item (sort keys %CannotResolve) { + print " $Item: $CannotResolve{$Item} Times\n"; + } + print "\n"; +} if (keys %InvalidCertificate) { print "Invalid certificates:\n"; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/logwatch-7.14/scripts/services/sshd new/logwatch-7.15/scripts/services/sshd --- old/logwatch-7.14/scripts/services/sshd 2025-12-24 02:41:00.000000000 +0100 +++ new/logwatch-7.15/scripts/services/sshd 2026-07-16 04:41:45.000000000 +0200 @@ -250,7 +250,7 @@ } elsif ( ($ThisLine =~ m/^(?:error:.*|fatal:) Connection closed by remote host/ ) or ($ThisLine =~ m/^(|fatal: )Read error from remote host(| [^ ]+)(| port \d+): Connection reset by peer/ ) or - ($ThisLine =~ m/^error: .*: read: Connection reset by peer/ ) or + ($ThisLine =~ m/^error: .*: (read|write): Connection reset by peer/ ) or ($ThisLine =~ m/^error: .*: write: Broken pipe/ ) or ($ThisLine =~ m/^Read error from remote host [^ ]+(| port \d+): (Connection timed out|No route to host)/ ) or ($ThisLine =~ m/^fatal: Read from socket failed: No route to host/) or @@ -328,7 +328,7 @@ $multiline++; } elsif ( ($Reason,$Offer) = ($ThisLine =~ /^(userauth_pubkey): (.*)( \[preaut\])?$/) ) { $multiline++; - } elsif ( ($Prio,$Host,$Port,$Code,$Reason) = ($ThisLine =~ /^(error: )?Received disconnect from ([^ ]*)( port \d+)?: ?(\d+): (.*)$/)) { + } elsif ( ($Prio,$Host,$Port,$Code,$Reason) = ($ThisLine =~ /^(error: )?Received disconnect from ([^ ]*)( port \d+)?: ?(\d+): ?(.*)$/)) { # Reason 11 ({SSH,SSH2}_DISCONNECT_BY_APPLICATION) is expected, and logged at severity level INFO if (($Reason =~ /preauth/) || ($Code != 11) || ($Detail >= 30)) { $DisconnectReceived{$Reason}{$Host}++; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/logwatch-7.14/scripts/services/systemd new/logwatch-7.15/scripts/services/systemd --- old/logwatch-7.14/scripts/services/systemd 2025-10-19 10:55:44.000000000 +0200 +++ new/logwatch-7.15/scripts/services/systemd 2026-07-16 04:41:45.000000000 +0200 @@ -103,6 +103,7 @@ $ThisLine =~ /^Queuing reload/ or $ThisLine =~ /^Relabell?ed / or $ThisLine =~ /^Reloading\.+$/ or # Happens on each boot at switch root + $ThisLine =~ /^Reload requested from client.*systemctl/ or $ThisLine =~ /^RTC configured in / or $ThisLine =~ /^Running in init(?:ial RAM disk|rd)\.$/ or $ThisLine =~ /^selinux: avc: *received policyload notice/ or @@ -136,6 +137,8 @@ $ThisLine =~ /has no hold-off time.*, scheduling restart\./ or $ThisLine =~ /Service Restart.* expired, scheduling restart\./ or $ThisLine =~ /Scheduled restart job, restart counter is at .*\./ or + # Harmless warning, hard to suppress - https://access.redhat.com/solutions/7041110 + $ThisLine =~ /^sys-module-fuse\.device: Failed to enqueue SYSTEMD_WANTS= job, ignoring: Unit sys-fs-fuse-connections\.mount not found\.$/ or $ThisLine =~ /: Watchdog timeout/ or $ThisLine =~ /Watchdog running with a (?:hardware )?timeout of/ or $ThisLine =~ /^Dependency failed for / or @@ -150,7 +153,7 @@ #$ThisLine =~ /PID file .* not readable \(yet\?\) after start/ or $ThisLine =~ /Failed to (read|parse) PID from file / or # Units can depend on files that do not exist - $ThisLine =~ /Cannot add dependency job(:? for unit .*)?, ignoring: Unit (:?.* failed to load: No such file or directory|not found)\.$/ or + $ThisLine =~ /Cannot add dependency job(?: for unit .*)?, ignoring: Unit (?:.* failed to load: No such file or directory|not found)\.$/ or # https://bugs.freedesktop.org/show_bug.cgi?id=90386 $ThisLine =~ /Dev(ice)? .* appeared twice with different sysfs paths .* and / or # Inactive units are sometimes reloaded @@ -166,7 +169,8 @@ # https://bugzilla.redhat.com/show_bug.cgi?id=1072368 $ThisLine =~ /^Received SIGRTMIN\+24 from PID \d+ \((?:kill|n\/a)\)\.$/ or $ThisLine =~ /: Killing process \d+ \(.*\) with signal SIG.+\.$/ or - $ThisLine =~ /: Sent signal SIGHUP to main process .* on client request\.$/ or + $ThisLine =~ /: Sending signal SIGUSR2 to process .* on client request/ or + $ThisLine =~ /: Sent signal (?:SIGHUP|SIGUSR2) to main process .* on client request\.$/ or $ThisLine =~ /^Removed slice / or $ThisLine =~ /^pam_unix\(systemd-user:session\): session (?:opened|closed) for user/ or $ThisLine =~ /Adding .* random time\.$/ or @@ -205,6 +209,8 @@ $ConfigError{$reason}{$service}++; } elsif (($reason,$service) = ($ThisLine =~ /^(ConfigurationDirectory .*)\. \((.*)\)$/)) { $ConfigError{$reason}{$service}++; + } elsif (($reason,$service) = ($ThisLine =~ /^(System is tainted): (unmerged-bin)$/)) { + $ConfigError{$reason}{$service}++ if $Detail >= 10; } elsif (($reason,$service) = ($ThisLine =~ /^(System is tainted): (.*)$/)) { $ConfigError{$reason}{$service}++; # Skipped goes before failed to catch "was skipped because all trigger condition checks failed." @@ -214,7 +220,7 @@ $Skipped{$name}++ if $Detail; } elsif (($name) = ($ThisLine =~ /^(.*) was skipped because/)) { $Skipped{$name}++ if $Detail; - } elsif (($service) = ($ThisLine =~ /(\S+): Failed (:?to execute command|with result)/)) { + } elsif (($service) = ($ThisLine =~ /(\S+): Failed (?:to execute command|with result)/)) { $Failed{$service}++; } elsif (($service) = ($ThisLine =~ /(\S+) failed\.$/)) { $Failed{$service}++;
