Git Repository Public Repository

logcheck

URLs

Copy to Clipboard
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
#!/usr/bin/perl

#    Logchecker - perl script to check unix logfiles and notify by email
#    if entries appear not covered by the whitelist
#    Copyright (C) long time ago by Peter, peters-webcorner.de
#
#    This program is free software: you can redistribute it and/or modify
#    it under the terms of the GNU General Public License as published by
#    the Free Software Foundation, either version 3 of the License, or
#    (at your option) any later version.
#
#    This program is distributed in the hope that it will be useful,
#    but WITHOUT ANY WARRANTY; without even the implied warranty of
#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#    GNU General Public License for more details.
#
#    You should have received a copy of the GNU General Public License
#    along with this program.  If not, see <https://www.gnu.org/licenses/>.

use File::Basename;
use File::Spec;
$dirname = File::Spec->rel2abs(dirname(__FILE__));

require $dirname.'/logcheck.conf';
$mode="run";

if (defined($logcheckpath)) {

	print "There was change in the configuration starting from version 1.0.5!\n";
	print "\n";
	print '$file_whitelist=$logcheckpath."logcheck.whitelist"; is now'."\n";
	print '$file_whitelist="logcheck.whitelist";'."\n";
	print "\n";
	print '$file_logfiles=$logcheckpath."logcheck.logfiles"; is now'."\n";
	print '$file_logfilelist="logcheck.logfiles";'."\n";
	print "\n";
	print '$logcheckpath="/your/path/"; is now'."\n";
	print '#$logcheckpath="/your/path/";'."\n";
	print "\nPlease make these changes before you continue using logcheck.pl\n";
	exit 1;
}

$file_pidfile = $dirname."/logcheck.pid";

$file_whitelist = $dirname."/".$file_whitelist;
$file_logfilelist = $dirname."/".$file_logfilelist;

sub head() {
	print "\n";
	print "-----------------------------\n";
	print "This is logcheck.pl V1.0.8\n";
	print "https://peters-webcorner.de\n";
	print "project hosted on github\n";
	print "https://github.com/pstimpel/logcheck\n\n";
	print "Logchecker - Copyright (C) long time ago by Peter\n";
    print "This program comes with ABSOLUTELY NO WARRANTY; for details run `-l'.\n";
    print "This is free software, and you are welcome to redistribute it\n";
    print "under certain conditions. Check license for details.\n";
	print "-----------------------------\n\n";
}

if (($ARGV[0] ne "") && ($ARGV[0] ne "debug") && ($ARGV[0] ne "-l") && ($ARGV[0] ne "-r") && ($ARGV[0] ne "-d")) {
	head();
	print "Parameters:\n";
	print "logcheck.pl         normal run, parse logfiles and fire email if needed\n";
	print "logcheck.pl debug   prevents script from sending mail\n";
	print "logcheck.pl -d      prevents script from sending mail\n";
	print "logcheck.pl -l      prints license to console\n";
	print "logcheck.pl -p      removes existing pid-file with no further checks\n";
	print "logcheck.pl -h      this screen\n";
	print "PID: ".$$." \n";
	print "DIR: ".$dirname."\n";
	getpidfilecontent();
	if($pidstring ne "unknown") {
		print "!!! PID-file existing, created by process ".$pidstring." !!!\n";
	}
	exit 0;

}

if ($ARGV[0] eq "-l") {
	head();
	print "Content of license\n\n\n";
	system('cat LICENSE | more');
	exit 0;
}

if ($ARGV[0] eq "-r") {
	head();
	unlink($file_pidfile);
	print "done...\n";
	exit 0;
}

if ($ARGV[0] eq "debug" || $ARGV[0] eq "-d") {
	head();
	print "debug mode on...\n";
	$mode="debug";

}

if (-e $file_whitelist) {
	if($mode eq "debug") {
		print "whitelist found...\n";
	}
} 
else 
{
	open(ADR, ">$file_whitelist");
	print ADR "";
	close(ADR);
	print "Please edit ".$file_whitelist." first...\n";
	exit 1;
              
}
if (-e $file_logfilelist) {
	if($mode eq "debug") {
		print "list of logfiles found...\n";
	}
} else {
	open(ADR, ">$file_logfilelist");
       	print ADR "";
       	close(ADR);
       	print "Please edit ".$file_logfilelist." first...\n";
       	exit 1;
              
}


$read=0;
open(ADR, "<$file_whitelist");
while(<ADR>)
{
	chop($_);
	if(length($_) > 1) {
		if (substr($_,0,1) ne "#") 
		{
		$read++;
		push @whitelisted, $_;
		}
	}
}
close(ADR);
if ($read > 0) {
	if($mode eq "debug") {
		print $read." entries in whitelist found\n";
	}
}
else
{
	if($mode eq "debug") {
		print "no entries in whitelist found, may be not normal...\n";
	}
}



$read=0;
open(ADR, "<$file_logfilelist");
while(<ADR>)
{
	chop($_);
	if(length($_) > 1) {
		if (substr($_,0,1) ne "#") 
		{
		$read++;
		push @logfiles, $_;
		}	
	}
}
close(ADR);
if ($read > 0) {
	if($mode eq "debug") {
		print $read." entries in logfile list found\n";
	}
}
else
{
	print "there must be at least one entry in "..$file_logfilelist."\n";
	print "ABORTING NOW!!!\n";
	exit 1;
}

if (-e $file_pidfile) {
	if($mode eq "debug") {
		print "There is a pid-file already, ".$file_pidfile.", abort execution\n";
		exit 1;
	} else {
		getpidfilecontent();
		$psstring = `ps fax`;
		$Jetztwert = time();
		$Jetztzeit = localtime($Jetztwert);
		$mailer = '/usr/sbin/sendmail';
		$Sender = $senderaddress;
		open(MAIL, "|$mailer -t") || die "Can't open $mailer!\n";
		print MAIL "To: ".$emailaddress."\n";
		print MAIL "Subject: Logs NOT CHECKED report $Jetztzeit\n\n\n";
		print MAIL "There is a pid-file already at ".$file_pidfile.", and the execution of logcheck was aborted!\n\nRemove the pid-file, but make sure logcheck is not running anymore. See output of ps fax below\n\n";
		print MAIL "Pid of this (the aborted process) is: ".$$."\n";
		print MAIL "Pid of blocking process is: ".$pidstring."\n\n";
		
		print MAIL $psstring."\n\n";
		close(MAIL);
		exit 1;
	}
}

open(ADR, ">$file_pidfile");
print ADR $$;
close(ADR);


foreach $thisfile (@logfiles) {
	$outtext="";
	$noffset="";
	$offset;
	$jumpover;
	if($mode eq "debug") {
		print "processing ".$thisfile."\n";
	}
	if(-e $thisfile) 
	{
		$useoffset=0;
		$thisoffset="";
		if(-e $thisfile.".offset") {
			if($mode eq "debug") {
				print "using ".$thisfile.".offset\n";
			}
			$useoffset=1;
			open(OFF,"<$thisfile.offset");
			while(<OFF>)
			{
				$offset=$_;
				if($mode eq "debug") {
					print "offset is $_\n";	
				}
			}
			close(OFF);
		}	
		$jumpover=1;	
		check();
		if($jumpover==1) {
			unlink($thisfile.".offset");
			if($mode eq "debug") {
				print "offset not found, reparsing without offset\n";	
			}
			$jumpover=0;
			$offset="";
			check();
		}
		if ($outtext ne "") {
			if($mode eq "debug") {
				print "mail not sent, cause debug is enabled\n";	
				print "content of mail to $emailaddress would be:\n---------------------------------\n";
				print $outtext;
				print "\n---------------------------------\nend of mail\n";
			} else {
				$Jetztwert = time();
				$Jetztzeit = localtime($Jetztwert);
				$mailer = '/usr/sbin/sendmail';
				$Sender = $senderaddress;
				open(MAIL, "|$mailer -t") || die "Can't open $mailer!\n";
				print MAIL "To: ".$emailaddress."\n";
				print MAIL "Subject: ($thisfile) violation report $Jetztzeit\n\n\n";
				print MAIL $outtext;
				close(MAIL);
				$command="\/usr\/bin\/logger -p warn logcheckprint";
                system($command);
			}
		} else {
			if($mode eq "debug") {
				print "nothing to send, $thisfile seems to be ok\n";	
			}
		}
		if ($noffset ne "") {
			if($mode eq "debug") {
				print "new offset written in ".$thisfile.".offset\n";	
			}
			open(ADR, ">$thisfile.offset");
			       print ADR $noffset;
			close(ADR);
		}
	}
	else
	{
		print STDERR "logfile $thisfile not found...ignoring\n";
	}	
}

unlink($file_pidfile);

exit 0;


sub check() {
	# checks the logfile itself
	open(LOG,"<$thisfile");
	while(<LOG>) 
	{
		if ($jumpover == 0) {
			$wl=0;
			foreach $wltext (@whitelisted) 
			{
				if($_ =~/$wltext/) 
				{
					$wl=1;
				}
			}
			if($wl==0) 
			{
				$outtext=$outtext.$_;
			}
		}	
		$noffset = substr($_,0,15,);
		if(substr($_,0,15) eq $offset) {
			$jumpover=0;
			if($mode eq "debug") {
				print "offset found\n";	
			}
		}
	}
	close(LOG);
}

sub getpidfilecontent() {
	$pidstring="unknown";
	open(ADR, "<$file_pidfile");
	while(<ADR>)
	{
		chop($_);
		if(length($_) > 1) {
			if (substr($_,0,1) ne "#") 
			{
				$pidstring = $_;
			}	
		}
	}
	close(ADR);
}

Commits for logcheck/logcheck.pl

Diff revisions: vs.
Revision Author Commited Message
6b4dd8 ... Diff Diff Peter Stimpel Wed 10 Oct, 2018 18:58:32 +0000

V1.0.8 Use the pl-files directory to include config file

fb67a8 ... Diff Diff github picture github Tue 09 Oct, 2018 06:23:45 +0000

V1.0.7 get working directory before including config

34a2af ... Diff Diff Peter Stimpel Tue 27 Feb, 2018 19:16:40 +0000

V 1.0.6
- check, if updated from 1.0.4 or below due changed structure of conf-file

3de031 ... Diff Diff Peter Stimpel Sun 25 Feb, 2018 16:34:08 +0000

V 1.0.5
- pid file handling, no logchecks if pid file exists
- removed path to logcheck setting from configuration, dynamic path recognition instead

f14b4c ... Diff Diff Peter Stimpel Sun 25 Feb, 2018 15:09:08 +0000

V 1.0.4
- changed license from GPL V2 to GPL V3, license file changed
- some cleaner output of help, contact details changed
- “-l” parameter introduced to print license file

65d0d4 ... Diff Diff pstimpel picture pstimpel Fri 13 Mar, 2015 11:40:40 +0000

Version 1.0.3
- adds a remark to logfiles if violations against the whitelist were found
- this remark was added to the whitelist (“logcheckprint”)

git-svn-id: https://xp-dev.com/svn/logcheck_svn/trunk@3 08cdd22e-cda9-4120-9a75-5d5767cdac8b

9da9af ... pstimpel picture pstimpel Fri 13 Mar, 2015 11:25:24 +0000

moving from Google Code

git-svn-id: https://xp-dev.com/svn/logcheck_svn/trunk@2 08cdd22e-cda9-4120-9a75-5d5767cdac8b