[Logwatch-Devel] patch to syslogd script (was: patch to removeheaders 1.14)

Markus Lude lude at informatik.uni-tuebingen.de
Sun Jan 1 18:43:42 MST 2006


On Sat, Dec 31, 2005 at 02:43:38AM +0100, Markus Lude wrote:
> On Fri, Dec 23, 2005 at 01:42:36PM +1100, David Baldwin wrote:
> > I wrote a new filter (for pubcookie if anyone is interested - can 
> > contribute it) and the service name included white space "pubcookie login 
> > server". Patch to 'removeheaders' script attached to handle that.
> 
> The removeheaders script now removes too much.
> In log entries like:
> 
> ... host service: foo: bar ...
> 
> " foo: " is removed too.
> 
> [^\[:] instead of [^\[] should fix this.
> 
> > David.

The change broke the syslogd script too.

Log entries like

Jan  1 02:02:27 hostname syslogd 1.4.1: restart.

were not matched any more.

The following change fixes this for the above log entry:

--- syslogd.org 2006-01-02 02:19:44.000000000 +0100
+++ syslogd     2006-01-02 02:21:45.000000000 +0100
@@ -21,7 +21,7 @@
    elsif ($ThisLine =~ /^syslogd .* restart\.$/) {
       $Starts++;
    }
-   elsif ($ThisLine eq "restart") {
+   elsif ($ThisLine =~ /^restart\.?$/) {
       $Starts++;
    }
    elsif ($ThisLine =~ /^Cannot glue message parts together$/) {


Regards,
Markus

> > --- scripts/shared/removeheaders        30 Nov 2005 23:52:27 -0000      1.14
> > +++ scripts/shared/removeheaders        23 Dec 2005 02:38:11 -0000
> > @@ -17,8 +17,8 @@
> > 
> >  while (defined($ThisLine = <STDIN>)) {
> >      #First line is Solaris ID tag style -mgt
> > -    $ThisLine =~ s/^... .. ..:..:.. [^ ]* [^ ]*(\[\d*\])?: \[ID \d+( \w+\.\w+)?] //;
> > -    $ThisLine =~ s/^... .. ..:..:.. [^ ]* [^ ]*(\[\d*\])?: //;
> > +    $ThisLine =~ s/^... .. ..:..:.. [^ ]* [^\[]*(\[\d*\])?: \[ID \d+( \w+\.\w+)?] //;
> > +    $ThisLine =~ s/^... .. ..:..:.. [^ ]* [^\[]*(\[\d*\])?: //;
> >      # the following is for those logs that use the service name, but do not
> >      # append the ':' right after (for example, syslogd restart).  Presumably
> >      # OnlyService is called before RemoveHeaders, so this should only be done

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url : http://ip70-176-100-107.ph.ph.cox.net/pipermail/logwatch-devel/attachments/20060101/cf77e940/attachment.bin


More information about the Logwatch-Devel mailing list