Re: Bug in logwatch? (not all archives are checked and --logdir is partially ignored).
On Mon, 30 Apr 2012 00:12:43 +0200, Maarten Derickx wrote: > 2012/4/29 Maarten Derickx > > >> A closer inspection of the logfiles I cared about revealed that there >> where also related errors. I made a patch with all the changes and >> posted it at http://pastebin.com/6vALKDYN . What is the procedure for >> getting these fixes in debian? >> >> >> > I filed the bugs and they have numbers: #670877 and #670880 > respectively. I was going to suggest exactly that... Well done! :-) Greetings, -- Camaleón -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/jnma4k$kbo$5...@dough.gmane.org
Re: Bug in logwatch? (not all archives are checked and --logdir is partially ignored).
2012/4/29 Maarten Derickx > > A closer inspection of the logfiles I cared about revealed that there where > also related errors. I made a patch with all the changes and posted it at > http://pastebin.com/6vALKDYN . What is the procedure for getting these fixes > in debian? > > > Thanks, > Maarten > > I filed the bugs and they have numbers: #670877 and #670880 respectively.
Re: Bug in logwatch? (not all archives are checked and --logdir is partially ignored).
Maarten Derickx wrote: > A closer inspection of the logfiles I cared about revealed that there > where also related errors. I made a patch with all the changes and > posted it at http://pastebin.com/6vALKDYN . What is the procedure for > getting these fixes in debian? Report it as a bug. Using 'reportbug' is typical but it can also be done by simple email. Here is the documentation page for how to submit a bug to Debian: http://www.debian.org/Bugs/Reporting Bob signature.asc Description: Digital signature
Re: Bug in logwatch? (not all archives are checked and --logdir is partially ignored).
> Look at one of the config files that manages sshd (secure.conf), I think > there can be a rule pattern definition error there. > > Greetings, > > -- > Camaleón Thanks. There where no config files in /etc/ (only a directory structure). But indeed there was a mistake in the file in /usr/share/logwatch/default.conf/logfiles/secure.conf There was a rule wich said: Archive = authlog.* But this line should read: Archive = auth.log.* A closer inspection of the logfiles I cared about revealed that there where also related errors. I made a patch with all the changes and posted it at http://pastebin.com/6vALKDYN . What is the procedure for getting these fixes in debian? Thanks, Maarten
Re: Bug in logwatch? (not all archives are checked and --logdir is partially ignored).
On Sun, 29 Apr 2012 14:39:08 +0200, Maarten Derickx wrote: (...) → About the problem of analyzing from the archive > The strange thing is that when I do: > > logwatch --service sshd --archives > > I get only 3 logins 2 from "mderickx" and 1 from "sageslave". (see > Output 1 below) (...) > The strange thing is that if I now do: > > root@md:/var/log# gzip auth.log.1 > > and then > > logwatch --service sshd --archives > > then I do get the expected amount of 10 logins for the user mderickx in > the logwatch output. So it seems that in contrast to the what the > documentation suggests the uncompressed archive /var/log/auth.log.1 is > not checked! Look at one of the config files that manages sshd (secure.conf), I think there can be a rule pattern definition error there. Logwatch seems to be configured to read either from "/var/log/ auth.log" (as the actual file) or "/var/log/auth.log.*.gz" files (for the archives) but does not handle non "*.gz" files with a different filename :-? → About the problem of setting a different directory for the logs (...) I leave this for others to debug :-P Greetings, -- Camaleón -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/jnjl13$5ol$1...@dough.gmane.org
