[Logwatch-Devel] logwatch samba:

Alex Schuilenburg alexs at ecoscentric.com
Sat Dec 10 07:04:57 MST 2005


Hi

The attached patch adds support for the modified samba log message that
samba on RHEL4 gives.  Namely of the form:

smbd/service.c:make_connection_snum(648)  fred (192.168.1.3) connect to
service foo initially as user alexs (uid=500, gid=5000) (pid 11390) : 1
Time(s)

where "initially" is now added (and made optional by the patch).

Hope you find this useful

-- Alex
-------------- next part --------------
--- samba	2005/12/10 13:56:37	1.1
+++ samba	2005/12/10 14:00:47
@@ -72,7 +72,7 @@
 		($ThisLine =~ /===============================================================/)
    ) {
       #Don't care about these...
-	} elsif ( ($Host, $Service, $User) = ( $ThisLine =~ /([^ ]+ \([^ ]+\)) connect to service ([^ ]+) as user ([^ ]+)/ ) ) {
+	} elsif ( ($Host, $Service, $User) = ( $ThisLine =~ /([^ ]+ \([^ ]+\)) connect to service ([^ ]+)(?: initially) as user ([^ ]+)/ ) ) {
 		$Connect{$Service}{$User}{$Host}++;
 	} elsif ( ($NoService) = ( $ThisLine =~ /couldn't find service (\S+)/ ) ) {
 		$NoServ{$NoService}++;


More information about the Logwatch-Devel mailing list