epylog January 2012

epylog@lists.fedorahosted.org

3 participants
307 discussions

[epylog: 270/297] Some more default setting tweaks.
by Konstantin Ryabitsev 23 Jan '12

23 Jan '12

commit f798a50d564a8f971a8521fdfc7f198a28464485 Author: Konstantin Ryabitsev <icon(a)mricon.com> Date: Thu Mar 31 20:16:19 2005 +0000 Some more default setting tweaks. etc/modules.d/mail.conf.in | 2 +- etc/weed_dist.cf | 7 ++++++- 2 files changed, 7 insertions(+), 2 deletions(-) --- diff --git a/etc/modules.d/mail.conf.in b/etc/modules.d/mail.conf.in index 38562e1..04e107e 100644 --- a/etc/modules.d/mail.conf.in +++ b/etc/modules.d/mail.conf.in @@ -12,7 +12,7 @@ priority = 5 # Enable sendmail, postfix, or both # enable_sendmail = 1 -enable_postfix = 0 +enable_postfix = 1 enable_qmail = 0 ## # Report at most this many "top things" diff --git a/etc/weed_dist.cf b/etc/weed_dist.cf index bedc43c..d3a703d 100644 --- a/etc/weed_dist.cf +++ b/etc/weed_dist.cf @@ -72,7 +72,7 @@ sshd.*: .* key generation complete sshd.*: Connection closed sshd.*: Could not reverse map address sshd.*: Received disconnect from -sshd.*: error: Could not get shadow information for NOUSER +sshd.*: error: Could not get shadow information for sshd.*: Invalid user .* from [xinetd] @@ -154,10 +154,14 @@ ntpd.*: kernel time discipline status change [kernel] kernel: application .* uses obsolete OSS audio interface kernel: SELinux: initialized +kernel: device .* left promiscuous mode +kernel: .*: disabled promiscuous mode usb-uhci.c: interrupt, status PCI: Found IRQ PCI: Sharing IRQ PCI: Setting latency timer +kernel: agpgart: Found +kernel: agpgart: Putting [misc] modprobe: Can't locate module @@ -171,4 +175,5 @@ dhclient: bound to dbus: avc: .* buckets used + ## $Revision$ ##

1 0

[epylog: 269/297] Some more rules.
by Konstantin Ryabitsev 23 Jan '12

23 Jan '12

commit 06efe48115e22f9b4fdaf793bdd9351de87967c3 Author: Konstantin Ryabitsev <icon(a)mricon.com> Date: Thu Mar 31 20:10:54 2005 +0000 Some more rules. etc/notice_dist.xml | 7 +++++++ etc/weed_dist.cf | 17 ++++++++++++----- 2 files changed, 19 insertions(+), 5 deletions(-) --- diff --git a/etc/notice_dist.xml b/etc/notice_dist.xml index a45bc21..354ff76 100644 --- a/etc/notice_dist.xml +++ b/etc/notice_dist.xml @@ -93,5 +93,12 @@ <report>Cron: user '%s' (%s)</report> </notice> + <notice id="promisc" critical="yes"> + <regex>device (\S+) entered promiscuous mode</regex> + <regex>(\S+): Promiscuous mode enabled</regex> + <regex>(\S+): enabled promiscuous mode</regex> + <report>device %s entered promiscuous mode</report> + </notice> + </notices> diff --git a/etc/weed_dist.cf b/etc/weed_dist.cf index 03d884b..bedc43c 100644 --- a/etc/weed_dist.cf +++ b/etc/weed_dist.cf @@ -72,6 +72,8 @@ sshd.*: .* key generation complete sshd.*: Connection closed sshd.*: Could not reverse map address sshd.*: Received disconnect from +sshd.*: error: Could not get shadow information for NOUSER +sshd.*: Invalid user .* from [xinetd] xinetd.*: .* Transport endpoint is not connected @@ -149,19 +151,24 @@ afpd.*: .*B read,.*B written [ntpd] ntpd.*: kernel time discipline status change +[kernel] +kernel: application .* uses obsolete OSS audio interface +kernel: SELinux: initialized +usb-uhci.c: interrupt, status +PCI: Found IRQ +PCI: Sharing IRQ +PCI: Setting latency timer + [misc] modprobe: Can't locate module logger: punching nameserver .* through the firewall HORDE\[\S*\s*\[imp\] Logout LOGIN ON tty. -usb-uhci.c: interrupt, status -PCI: Found IRQ -PCI: Sharing IRQ -PCI: Setting latency timer dhclient: DHCPREQUEST dhclient: DHCPACK dhclient: DHCPDISCOVER dhclient: bound to -kernel: application .* uses obsolete OSS audio interface +dbus: avc: .* buckets used + ## $Revision$ ##

1 0

[epylog: 268/297] Adding a few rules.
by Konstantin Ryabitsev 23 Jan '12

23 Jan '12

commit 4bf8cb0fffe65bf720babaf922d995726d750b80 Author: Konstantin Ryabitsev <icon(a)mricon.com> Date: Thu Mar 31 20:02:24 2005 +0000 Adding a few rules. etc/modules.d/weeder.conf.in | 2 +- etc/notice_dist.xml | 10 ++++++++++ etc/weed_dist.cf | 1 + 3 files changed, 12 insertions(+), 1 deletions(-) --- diff --git a/etc/modules.d/weeder.conf.in b/etc/modules.d/weeder.conf.in index 9547435..46c836e 100644 --- a/etc/modules.d/weeder.conf.in +++ b/etc/modules.d/weeder.conf.in @@ -27,4 +27,4 @@ weed_local = %%pkgconfdir%%/weed_local.cf # # You can use 'ALL' to enable all sections. # -enable = pam, rpc, automount, crond, gnome, sshd, xinetd, misc +enable = ALL diff --git a/etc/notice_dist.xml b/etc/notice_dist.xml index 6e0dde0..a45bc21 100644 --- a/etc/notice_dist.xml +++ b/etc/notice_dist.xml @@ -83,5 +83,15 @@ <report>insmod errors</report> </notice> + <notice id="selinux-denied"> + <regex>audit\S+:\s+avc:\s+denied\s+\{\s([^\}]+)\s\}.*exe=(\S+).*scontext=(\S+)</regex> + <report>SELinux: denied "%s" for "%s" (scontext=%s)</report> + </notice> + + <notice id="crond"> + <regex>CROND\S+: $(\S+)$ CMD $([^$]+)\)</regex> + <report>Cron: user '%s' (%s)</report> + </notice> + </notices> diff --git a/etc/weed_dist.cf b/etc/weed_dist.cf index a210f00..03d884b 100644 --- a/etc/weed_dist.cf +++ b/etc/weed_dist.cf @@ -160,6 +160,7 @@ PCI: Sharing IRQ PCI: Setting latency timer dhclient: DHCPREQUEST dhclient: DHCPACK +dhclient: DHCPDISCOVER dhclient: bound to kernel: application .* uses obsolete OSS audio interface

1 0

[epylog: 267/297] That was a nice bug. ;)
by Konstantin Ryabitsev 23 Jan '12

23 Jan '12

commit efbd359a782529fa6f71a0be3e9caf2b73d6f838 Author: Konstantin Ryabitsev <icon(a)mricon.com> Date: Thu Mar 31 19:50:43 2005 +0000 That was a nice bug. ;) configure.in | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) --- diff --git a/configure.in b/configure.in index 1188272..2a4dfd3 100644 --- a/configure.in +++ b/configure.in @@ -96,7 +96,7 @@ AC_SUBST(PY_MODULE_DIR) AC_MSG_CHECKING(for --with-python-dirs) AC_ARG_WITH(python-dirs, [ --with-python-dirs Put modules in python's site-packages dir], [ - PY_MODULE_DIR=$PY_STD_LIB + PY_MODULE_DIR=$withval AC_MSG_RESULT(yes) ], [

1 0

[epylog: 266/297] python_sitelib
by Konstantin Ryabitsev 23 Jan '12

23 Jan '12

commit 3c66bafabd148a0198f5d3ae0fc917c7633b6124 Author: Konstantin Ryabitsev <icon(a)mricon.com> Date: Thu Mar 31 19:46:39 2005 +0000 python_sitelib epylog.spec | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) --- diff --git a/epylog.spec b/epylog.spec index 1bd0b47..8510a9f 100644 --- a/epylog.spec +++ b/epylog.spec @@ -52,6 +52,7 @@ external perl modules, or intend to write some of your own. # %configure \ --with-python=%{__python} \ + --with-python-dirs=%{_python_sitelib} \ --with-lynx=%{_bindir}/links \ --with-site-perl=%{_perl_vendorlib} ##

1 0

[epylog: 265/297] Accommodate perl_vendorlib
by Konstantin Ryabitsev 23 Jan '12

23 Jan '12

commit 08e0a54337711b99ba2a3d54d657795757f7225f Author: Konstantin Ryabitsev <icon(a)mricon.com> Date: Thu Mar 31 19:44:55 2005 +0000 Accommodate perl_vendorlib configure.in | 2 +- epylog.spec | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) --- diff --git a/configure.in b/configure.in index 2e91077..1188272 100644 --- a/configure.in +++ b/configure.in @@ -2,7 +2,7 @@ dnl Process this file with autoconf to produce a configure script AC_INIT(epylog.spec) PACKAGE_TARNAME=epylog -PACKAGE_VERSION=1.0.2 +PACKAGE_VERSION=1.0.3 dnl Package information. PACKAGE=$PACKAGE_TARNAME diff --git a/epylog.spec b/epylog.spec index fbc1ced..1bd0b47 100644 --- a/epylog.spec +++ b/epylog.spec @@ -52,7 +52,8 @@ external perl modules, or intend to write some of your own. # %configure \ --with-python=%{__python} \ - --with-lynx=%{_bindir}/links + --with-lynx=%{_bindir}/links \ + --with-site-perl=%{_perl_vendorlib} ## # Fix version. #

1 0

[epylog: 264/297] Woops.
by Konstantin Ryabitsev 23 Jan '12

23 Jan '12

commit 29bd08c9b9945492fdb2a68516eff2aca473c7e7 Author: Konstantin Ryabitsev <icon(a)mricon.com> Date: Thu Mar 31 19:41:27 2005 +0000 Woops. epylog.spec | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) --- diff --git a/epylog.spec b/epylog.spec index 526bf3c..fbc1ced 100644 --- a/epylog.spec +++ b/epylog.spec @@ -51,7 +51,7 @@ external perl modules, or intend to write some of your own. # run. # %configure \ - --with-python=%{_python} \ + --with-python=%{__python} \ --with-lynx=%{_bindir}/links ## # Fix version.

1 0

[epylog: 263/297] Preparing for 1.0.3 and Fedora Extras.
by Konstantin Ryabitsev 23 Jan '12

23 Jan '12

commit 825f399ba5ce85569d9055197dec02da7de02272 Author: Konstantin Ryabitsev <icon(a)mricon.com> Date: Thu Mar 31 19:37:42 2005 +0000 Preparing for 1.0.3 and Fedora Extras. ChangeLog | 11 ++++-- epylog.spec | 93 +++++++++++++++++++++++++------------------------ etc/weed_dist.cf | 9 ++++- modules/logins_mod.py | 5 ++- 4 files changed, 66 insertions(+), 52 deletions(-) --- diff --git a/ChangeLog b/ChangeLog index d3b8fe3..197972c 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,12 +1,17 @@ +Epylog-1.0.3 + * Preparing for the submission to Fedora Extras + * Ignore "su" performed by crond to cut down on noise + * Add a few extra ignore rules for newer OSes + Epylog-1.0.2 - * Small modification to collapse login reports - * Fix monthmap on python-2.4 + * Small modification to collapse login reports + * Fix monthmap on python-2.4 Epylog-1.0.1 * Tiny fixes with Cyrus handling routines in logins, which made them not work. * Automatically detect python version during .spec building. - * Cleaned up trojans.list so it's less ugly + * Cleaned up trojans.list so it's less ugly Epylog-1.0 * Out with 1.0 already! diff --git a/epylog.spec b/epylog.spec index 2ff8cc0..526bf3c 100644 --- a/epylog.spec +++ b/epylog.spec @@ -1,28 +1,25 @@ -# $Id$ +%{!?_python_sitelib: %define _python_sitelib %(%{__python} -c "from distutils.sysconfig import get_python_lib; print get_python_lib()")} +%{!?_perl_vendorlib: %define _perl_vendorlib %(eval "`perl -V:installvendorlib`"; echo $installvendorlib)} -%define _pyver %(python -c 'import sys; print sys.version[:3],') -%define _python %{_bindir}/python%{_pyver} -%define _vardir %{_localstatedir}/lib -%define _pydir %{_libdir}/python%{_pyver}/site-packages -%define _perldir %{_libdir}/perl5/site_perl - -#------------------------------------------------------------------------------ - -Summary: New logs analyzer and parser. Name: epylog -Version: 1.0.2 -Release: 1.%{_pyver} +Version: 1.0.3 +Release: 1 Epoch: 0 -License: GPL +Summary: New logs analyzer and parser + Group: Applications/System -Source: http://linux.duke.edu/projects/epylog/download/%{name}-%{version}.tar.gz +License: GPL URL: http://linux.duke.edu/projects/epylog/ + +Source: http://linux.duke.edu/projects/epylog/download/epylog-1.0.3.tar.gz BuildRoot: %{_tmppath}/%{name}-%{version}-root BuildArch: noarch -BuildPrereq: perl, %{_python}, gzip, sed -Requires: %{_python}, libxml2-python -Obsoletes: dulog + +BuildRequires: python-devel, sed >= 4 +Requires: python-abi = %(%{__python} -c "import sys ; print sys.version[:3]") +Requires: libxml2-python + %description Epylog is a new log notifier and parser which runs periodically out of @@ -32,13 +29,13 @@ output. It is written specifically with large network clusters in mind where a lot of machines (around 50 and upwards) log to the same loghost using syslog or syslog-ng. -#------------------------------------------------------------------------------ %package perl Summary: Perl module for writing external Epylog modules Group: Development/Libraries -Requires: epylog = %{version}, perl >= 5.6 -Provides: perl(epylog) +Requires: epylog +Requires: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version)) + %description perl This package provides a perl module for epylog. It is useful for @@ -46,69 +43,73 @@ writing epylog modules that use external module API. No modules shipping with epylog by default use that API, so install this only if you are using external perl modules, or intend to write some of your own. -#------------------------------------------------------------------------------ %prep %setup -q +## +# The --with-lynx is just a sane default. It doesn't actually require it to +# run. +# %configure \ --with-python=%{_python} \ - --with-lynx=/usr/bin/links + --with-lynx=%{_bindir}/links ## # Fix version. # -%{__perl} -pi -e \ +sed -i -e \ "s/^VERSION\s*=\s*.*/VERSION = '%{name}-%{version}-%{release}'/g" \ py/epylog/__init__.py -#------------------------------------------------------------------------------ %build -%{__make} +make -#------------------------------------------------------------------------------ %install -%{__rm} -rf %{buildroot} -%{__make} install DESTDIR=%{buildroot} +rm -rf %{buildroot} +make install DESTDIR=%{buildroot} ## # Remove installed docs # -%{__rm} -rf %{buildroot}%{_defaultdocdir} +rm -rf %{buildroot}%{_defaultdocdir} ## # Move docs to doc # -%{__mv} AUTHORS ChangeLog INSTALL LICENSE README doc/ +mv AUTHORS ChangeLog INSTALL LICENSE README doc/ -#------------------------------------------------------------------------------ %clean -%{__rm} -rf %{buildroot} +rm -rf %{buildroot} -#------------------------------------------------------------------------------ %files -%defattr(-,root,root) +%defattr(-,root,root,-) %doc doc/* -%config(noreplace) %{_sysconfdir}/%{name} -%dir %{_vardir}/%{name} -%dir %{_datadir}/%{name} -%{_datadir}/%{name}/modules/* -%{_pydir}/%{name} -%{_sbindir}/%{name} -%{_sysconfdir}/cron.daily/%{name}.cron -%{_mandir}/man5/* +%config(noreplace) %{_sysconfdir}/epylog +%dir %{_localstatedir}/lib/epylog +%dir %{_datadir}/epylog +%{_datadir}/epylog/modules/* +%{_python_sitelib}/epylog +%{_sbindir}/epylog +%{_sysconfdir}/cron.*/* %{_mandir}/man8/* +%{_mandir}/man5/* + -#------------------------------------------------------------------------------ %files perl -%defattr(-,root,root) -%{_perldir}/%{name}.pm +%defattr(-,root,root,-) +%{_perl_vendorlib}/epylog.pm %{_mandir}/man3/* -#------------------------------------------------------------------------------ + %changelog +* Thu Mar 31 2005 Konstantin Ryabitsev <icon(a)linux.duke.edu> 1.0.3-1 +- Rework the specfile to match Fedora Extras format. +- Use _perl_vendorlib +- Use _python_sitelib + * Wed May 19 2004 Konstantin Ryabitsev <icon(a)linux.duke.edu> 1.0.1-1 - Use automatic _pyver determination to make rebuilds simpler. - Don't gzip man, it will be done automatically. diff --git a/etc/weed_dist.cf b/etc/weed_dist.cf index 794b343..a210f00 100644 --- a/etc/weed_dist.cf +++ b/etc/weed_dist.cf @@ -10,8 +10,8 @@ $pam_unix$.*: check pass; [dhcpd] -dhcpd: DHCPREQUEST for -dhcpd: DHCPACK on +dhcpd: DHCPREQUEST +dhcpd: DHCPACK dhcpd: DHCPDISCOVER dhcpd: DHCPOFFER dhcpd: DHCPRELEASE @@ -107,6 +107,7 @@ pop3d.*: LOGOUT, ip=\[\S+\] postfix/smtp\[\d+\]: connect to postfix/smtp\[\d+\]: warning: no MX host postfix/smtp\[\d+\]: warning: numeric domain name in resource data +postfix/smtp\[\d+\]: warning: host .* with my own hostname postfix/smtpd.*: connect from postfix/smtpd.*: disconnect from postfix/smtpd.*: TLS connection established @@ -157,5 +158,9 @@ usb-uhci.c: interrupt, status PCI: Found IRQ PCI: Sharing IRQ PCI: Setting latency timer +dhclient: DHCPREQUEST +dhclient: DHCPACK +dhclient: bound to +kernel: application .* uses obsolete OSS audio interface ## $Revision$ ## diff --git a/modules/logins_mod.py b/modules/logins_mod.py index bb64153..34b45c6 100644 --- a/modules/logins_mod.py +++ b/modules/logins_mod.py @@ -44,7 +44,10 @@ class logins_mod(InternalModule): self.failure = 2 self.root_open = 11 self.root_failure = 12 - self.pam_ignore = [] + ## + # Ignore crond(pam_unix), to lessen the noise + # + self.pam_ignore = ['crond'] self.xinetd_ignore = [] ##

1 0

[epylog: 262/297] Prepping for 1.0.2
by Konstantin Ryabitsev 23 Jan '12

23 Jan '12

commit fcba530cc6bb6e922b47a667610316bdff9b92ad Author: Konstantin Ryabitsev <icon(a)mricon.com> Date: Mon Mar 21 15:23:56 2005 +0000 Prepping for 1.0.2 ChangeLog | 4 ++++ configure.in | 2 +- epylog.spec | 2 +- py/epylog/__init__.py | 2 +- 4 files changed, 7 insertions(+), 3 deletions(-) --- diff --git a/ChangeLog b/ChangeLog index c23495c..d3b8fe3 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,7 @@ +Epylog-1.0.2 + * Small modification to collapse login reports + * Fix monthmap on python-2.4 + Epylog-1.0.1 * Tiny fixes with Cyrus handling routines in logins, which made them not work. diff --git a/configure.in b/configure.in index f076b61..2e91077 100644 --- a/configure.in +++ b/configure.in @@ -2,7 +2,7 @@ dnl Process this file with autoconf to produce a configure script AC_INIT(epylog.spec) PACKAGE_TARNAME=epylog -PACKAGE_VERSION=1.0 +PACKAGE_VERSION=1.0.2 dnl Package information. PACKAGE=$PACKAGE_TARNAME diff --git a/epylog.spec b/epylog.spec index 14ff870..2ff8cc0 100644 --- a/epylog.spec +++ b/epylog.spec @@ -11,7 +11,7 @@ Summary: New logs analyzer and parser. Name: epylog -Version: 1.0.1 +Version: 1.0.2 Release: 1.%{_pyver} Epoch: 0 License: GPL diff --git a/py/epylog/__init__.py b/py/epylog/__init__.py index 6f45b05..86b45ae 100644 --- a/py/epylog/__init__.py +++ b/py/epylog/__init__.py @@ -47,7 +47,7 @@ from report import Report from module import Module from log import LogTracker -VERSION = 'Epylog-1.0.1' +VERSION = 'Epylog-1.0.2' CHUNK_SIZE = 8192 GREP_LINES = 10000 QUEUE_LIMIT = 500

1 0

[epylog: 261/297] Collapses for logins, and fix for monthmap on python-2.4
by Konstantin Ryabitsev 23 Jan '12

23 Jan '12

commit d062235d748717e0d95cd4ad6f95e752abd74a44 Author: Konstantin Ryabitsev <icon(a)mricon.com> Date: Mon Mar 21 15:20:49 2005 +0000 Collapses for logins, and fix for monthmap on python-2.4 etc/modules.d/logins.conf.in | 4 ++++ modules/logins_mod.py | 12 +++++++++--- py/epylog/log.py | 4 ++-- 3 files changed, 15 insertions(+), 5 deletions(-) --- diff --git a/etc/modules.d/logins.conf.in b/etc/modules.d/logins.conf.in index 1c751d6..fa5867d 100644 --- a/etc/modules.d/logins.conf.in +++ b/etc/modules.d/logins.conf.in @@ -33,3 +33,7 @@ enable_proftpd = 0 # this off specify something like: # safe_domains = !.* safe_domains = .* +## +# If you have too many systems, wide-scale probing may turn ugly. This +# will collapse the reports. +systems_collapse = 10 diff --git a/modules/logins_mod.py b/modules/logins_mod.py index 983e203..bb64153 100644 --- a/modules/logins_mod.py +++ b/modules/logins_mod.py @@ -153,6 +153,7 @@ class logins_mod(InternalModule): self.safe_domains = [] safe_domains = opts.get('safe_domains', '.*') + self.systems_collapse = int(opts.get('systems_collapse', '10')) for domain in safe_domains.split(','): domain = domain.strip() if domain: @@ -216,6 +217,7 @@ class logins_mod(InternalModule): self.flip = ' bgcolor="#dddddd"' self.line_rep = '<tr%s><td valign="top" width="15%%">%s</td><td valign="top" width="15%%">%s</td><td width="70%%">%s</td></tr>\n' + self.collapsed_rep = '%s <font color="red">[%s more skipped]</font>' ## # LINE MATCHING ROUTINES @@ -673,9 +675,13 @@ class logins_mod(InternalModule): mymap = rs.get_submap((action, key, service)) key2s = [] for key2 in mymap.keys(): - field = key2[0] - key2s.append('%s(%d)' % (field, mymap[key2])) - service_rep.append([service, ', '.join(key2s)]) + loghost = key2[0] + key2s.append('%s(%d)' % (loghost, mymap[key2])) + if len(key2s) > self.systems_collapse: + loghosts = self.collapsed_rep % (key2s[0],len(key2s)-1) + else: + loghosts = ', '.join(key2s) + service_rep.append([service, loghosts]) blank = 0 for svcrep in service_rep: if blank: key = ' ' diff --git a/py/epylog/log.py b/py/epylog/log.py index 07a2557..30b2e39 100644 --- a/py/epylog/log.py +++ b/py/epylog/log.py @@ -52,8 +52,8 @@ def mkmonthmap(): pad = 2 months = [] for i in range(0, 12): - months.append(time.strftime("%b", (0, i+1, 0, 0, - 0, 0, 0, 0, 0))) + months.append(time.strftime("%b", (1, i+1, 1, 1, + 1, 1, 1, 1, 1))) basetime = time.localtime(time.time()) now_year = basetime[0] now_month = basetime[1]

1 0

← Newer
1
2
3
4
5
6
7
8
...
31
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

epylog January 2012