similar to: Bug#406973: logtail misses lines in rotated file

Hi gang, While writing a script that uses logtail, I noticed that logtail assumes nothing interesting happened between its last invocation and the rotation, which means that exciting bits of data could be lost. This seems a bit dodgy (correct me if I'm wrong about how it works!) so I made a dodgy patch to logtail that checks for the existence of $logfile.0, which on Debian seems to always be

Package: logcheck Version: 1.2.41 Problem: Logcheck try to detect if log file have been rotate or not by file size way. Possible attack: - current log file (sizeA) - run logcheck, (logcheck/logtail put inode in offsetfile), offset=sizeA - [attacker run attack 1] - run logrotate - [attacker run attack 2] - run logcheck may don't detect the rotation and don't check the log for attack 1

Package: logtail Version: 1.2.33 Severity: normal Hi... Logtail should not output error messages to standard output, since this violates the principle of least surprise. In particular, my application was broken by the semantics of logtail changing in version 1.2.21 (when you added switches for the default arguments to logtail). I think this was a bad move -- you broke an interface used by

From: Nicholas Bellinger <nab at linux-iscsi.org> This patch follows MST's recommendation to move checks for vhost_verify_ring_mappings() -> cpu_physical_memory_map() operations from MemoryListener->region_[add,del]() -> vhost_set_memory() into final MemoryListener->commit() -> vhost_commit() callback. It addresses the case where virtio-scsi vq ioport RAM re-mapping to

From: Nicholas Bellinger <nab at linux-iscsi.org> This patch follows MST's recommendation to move checks for vhost_verify_ring_mappings() -> cpu_physical_memory_map() operations from MemoryListener->region_[add,del]() -> vhost_set_memory() into final MemoryListener->commit() -> vhost_commit() callback. It addresses the case where virtio-scsi vq ioport RAM re-mapping to

Package: logcheck wanted to work on #195935, but found a less than funny issue, easy to reproduce: * remove some lines in front of your logfile * invoke logcheck you'll get a big email with all not matching lines from that log. not setting that to high priority because you are getting also the newer loglines. don't know if i find time that weekend. wanted to document it anyways. a++

Hi Xiantao, I general I think the code in this patch is fine. I have a couple of nit-picking comments: > + if (target_mask&0x1) { The formatting here isn't quite what most of the kernel does. It would be better if you added spaces so it's a little easier to read, ie: if (target_mask & 0x1) { > + p = &__per_cpu_idtrs[cpu][0][0]; > + for (i = IA64_TR_ALLOC_BASE;

Hi Xiantao, I general I think the code in this patch is fine. I have a couple of nit-picking comments: > + if (target_mask&0x1) { The formatting here isn't quite what most of the kernel does. It would be better if you added spaces so it's a little easier to read, ie: if (target_mask & 0x1) { > + p = &__per_cpu_idtrs[cpu][0][0]; > + for (i = IA64_TR_ALLOC_BASE;

Package: logcheck Version: 1.2.27 Severity: wishlist hello, in ignore.d.server/oidentd you have: ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ oidentd\[[0-9]+\]: Connection from \ [._[:alnum:]-]+ \([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\):[0-9]{1,5}$ anyway, some oidentd logs don't have a hostname: oidentd[34562]: Connection from 241.145.24.135:2353 therefore you have to add: ^\w{3} [

# Automatically generated email from bts, devscripts version 2.10.35 # via tagpending # # logcheck (1.3.2) experimental; urgency=low # # * Apply patch from Jari Aalto for fixing package description paragraph # ordering by importence, thanks (closes: #499415) # * Supress cron session closed messages too, thanks to Ferenc Wagner for # noticing (closes: #499393) # package logcheck-database

# Automatically generated email from bts, devscripts version 2.10.35 # via tagpending # # logcheck (1.3.2) experimental; urgency=low # # * Apply patch from Jari Aalto for fixing package description paragraph # ordering by importence, thanks (closes: #499415) # package logcheck-database logtail logcheck tags 499415 + pending

hi before checking in that chown fix, i wanted you to take a look. tested on my workstation. basicaly the patch takes care that logtail saves the offset file with the correct permissions. when playing around lately with file tampering and those invoking logcheck as root. i got similar output to #253998 Alfie may point out that i should not invoke logcheck as root, but i better fix that before

# Automatically generated email from bts, devscripts version 2.10.30 # via tagpending # # logcheck (1.2.65) unstable; urgency=low # # * ignore.d.server/courier: # - update rules to include port information; thanks to Antoine Pardignon # (closes: #446310). # - ignore couriertcpd messages; thanks to Andrew Gallagher # (closes: #451118). # * ignore.d.server/smbd_audit: # -

# Automatically generated email from bts, devscripts version 2.10.27 # # logcheck (1.2.64) unstable; urgency=low # # * ignore.d.server/dhcp # - Adding dhcp rules for DNS updates by ddns_remove_a() # (closes: #459875, #472368) # - Added dhcp "removed reverse map" rule, which occurs on DHCPRELEASE. # * ignore.d.server/spamd # - deal with socket connections by e.g. evolution

On Sat, 15 May 2004, CVS User ttroxell wrote: > if [ -f /etc/logcheck/header.txt ] ; then > - $CAT /etc/logcheck/header.txt >> $TMPDIR/report > + $CAT /etc/logcheck/header.txt >> $TMPDIR/report \ > + || error "Could not append header to $TMPDIR/report Disk full?" > fi > } > > @@ -152,7 +157,8 @@ > # Add a footer

# Automatically generated email from bts, devscripts version 2.10.30 # via tagpending # # logcheck (1.2.65) unstable; urgency=low # # * ignore.d.server/postfix: # - ignore connection messages for anonymous TLS connections; thanks to # Justin Larue (closes: #486440). # - ignore hostname verification due to DNS name not found; thanks to # Justin Larue (closes: #486440). # *

# Automatically generated email from bts, devscripts version 2.10.35 # via tagpending # # logcheck (1.3) unstable; urgency=low # # * Formalise the dropping of violations.d/logcheck. Please see # /usr/share/doc/logcheck-database/NEWS.Debian.gz for more information # (closes: #471072). # * Add Auto-Submitted header to outgoing mails (closes: #489172). # * ignore.d.server/kernel: # -

Package: logtail Version: 1.2.68 Severity: normal Hi, logtail does not cleanly update from logtail2: $ sudo dpkg --install /var/cache/apt/archives/logtail_1.2.68_all.deb (Reading database ... 26564 files and directories currently installed.) Unpacking logtail (from .../logtail_1.2.68_all.deb) ... dpkg: error processing /var/cache/apt/archives/logtail_1.2.68_all.deb (--install): trying to

# Automatically generated email from bts, devscripts version 2.10.18.1 # # logcheck (1.2.64) unstable; urgency=low # # * ignore.d.server/bind: # - moved "[bind] query $FOO denied" rule to violations.ignore.d # (closes: #443881). # - added bind's "AXFR ended" rule alongside "AXFR started" # (closes: #445046). # - added "adding an

Package: logcheck Version: 1.2.32 Severity: minor "Ghandi" should be "Gandhi" in README.how.to.interpret, assuming that you mean the Indian freedom fighter M.K. Gandhi a.k.a. Mahatma Gandhi. -- System Information: Debian Release: 3.1 APT prefers unstable APT policy: (500, 'unstable') Architecture: i386 (i686) Kernel: Linux 2.6.7 Locale: LANG=C, LC_CTYPE=C