view common/logwatch/http-error @ 192:893391e42d94 puppet-3.6

Update logwatch fail2ban handling for v0.10 log changes * Ignore "Flush tickets" * Tighten regex so "[rule] Restore Ban" doesn't become separate "rule] Restore"
author IBBoard <dev@ibboard.co.uk>
date Tue, 12 Feb 2019 21:04:51 +0000
parents 8316d4e55e92
children
line wrap: on
line source

#!/usr/bin/perl
#
##########################################################################
## Copyright (c) 2016 Logwatch
## Covered under the included MIT/X-Consortium License:
##    http://www.opensource.org/licenses/mit-license.php
## All modifications and contributions by other persons to
## this script are assumed to have been donated to the
## Logwatch project and thus assume the above copyright
## and licensing terms.  If you want to make contributions
## under your own copyright or a different license this
## must be explicitly stated in the contribution an the
## Logwatch project reserves the right to not accept such
## contributions.  If you have made significant
## contributions to this script and want to claim
## copyright please contact logwatch-devel@lists.sourceforge.net.
##########################################################################

use diagnostics;
use strict;

my $Detail = $ENV{'LOGWATCH_DETAIL_LEVEL'} || 0;

sub CustomizeErrorString {
   my ($LogLevel, $ErrorCode, $Description) = @_;
   # This function is only invoked when detail is set to 8 or 9.
   # Here you would modify the Description.  Some Description strings
   # may differ only on some printed parameters, and it is preferable
   # to group them together.  Examples of these may be process numbers,
   # IP addresses, port numbers, or file names.  The purpose of this
   # function is to "collapse" these different messages into the same
   # array entry.

   # For now, simply return the string.
   return($Description);
}

my %LogMessages = ();
my $MatchFilter = $ENV{'http_error_matchfilter'} || "";
my $ReportFilter = $ENV{'http_error_reportfilter'} || "";

while (defined(my $ThisLine = <STDIN>)) {
   if (my ($LogLevel, $ErrorCode, $Description) =
      ($ThisLine =~ /:(.*?)\].*(AH\d{5}): (.*)/) ) {
   # $MatchFilter is a variable that is set by setting the
   # $HTTP_Error_MatchFilter variable in the conf/services/http-error.conf
   # file.  It is executed here, before any other matching statements.
   eval $MatchFilter;
   if ($@) {
      print $@;
      print "While processing MatchFilter:\n$MatchFilter\n";
   }
   # $ThisLine might have been reset (undef, or empty string) in $MatchFilter
   next unless $ThisLine;

      if (($Detail == 8) || ($Detail == 9)) {
         $Description = CustomizeErrorString($LogLevel, $ErrorCode, $Description);
      }
      if (($Detail >= 1) || ($LogLevel =~ "emerg|alert|crit|error")) {
         $LogMessages{$LogLevel}{$ErrorCode}{$Description}++;
      }
   }
}

# $ReportFilter is a variable that is set by setting the
# $HTTP_Error_ReportFilter variable in the conf/services/http-error.conf
# file.  It is executed here, before any other printing statements.
eval $ReportFilter;
if ($@) {
   print $@;
   print "While processing ReportFilter:\n$ReportFilter\n";
}

if (keys %LogMessages) {
   my $Count = 0;
   foreach my $LogLevel (keys %LogMessages) {
      printf("\nLevel %-6s", $LogLevel);
      foreach my $ErrorCode (keys %{$LogMessages{$LogLevel}}) {
         print "\n   Error Code: $ErrorCode" if $Detail >= 5;
         foreach my $Description (keys %{$LogMessages{$LogLevel}{$ErrorCode}}) {
            if ($Detail >= 9) {
               print "\n      $Description:  ";
               print "$LogMessages{$LogLevel}{$ErrorCode}{$Description} Time(s)";
            }
            $Count += $LogMessages{$LogLevel}{$ErrorCode}{$Description};
         } # foreach $Description
         if (($Detail >= 5) && ($Detail < 9)) { 
            printf(":  %5d Time(s)", $Count);
            $Count = 0;
            if ($Detail >=6) {
               print "\n      E.g.: ";
               # print only first entry (index 0)
               my $EG_string = (keys %{$LogMessages{$LogLevel}{$ErrorCode}})[0];
               if (($Detail == 6) && (length($EG_string) > 66)) {
                  printf ("%.62s ...", $EG_string);
               } else {
                  print $EG_string;
               }
            }
         }
      } # foreach $ErrorCode
      if ($Detail < 5) { 
         printf("%s%5d%s", ":  ", $Count, " Time(s)");
         $Count = 0;
      }
   } # foreach $LogLevel
} # if keys %LogMessages

exit(0);

# vi: shiftwidth=3 tabstop=3 syntax=perl et
# Local Variables:
# mode: perl
# perl-indent-level: 3
# indent-tabs-mode: nil
# End: