[CentOS] Logwatch not working properly

Sat Nov 6 16:17:54 UTC 2010
Albert McCann <mac358 at newsguy.com>

I having a problem where Logwatch is not showing any events from the
/var/log/secure log file. When I run

logwatch --print --range today --service sshd --detail 10 --debug 10

the end result shows this:

...
LogFiles that will be processed:
[0] = secure
[1] = messages

Made Temp Dir: /var/cache/logwatch/logwatch.sOga48bL with tempdir
export LOGWATCH_DATE_RANGE='today'
export LOGWATCH_GLOBAL_DETAIL='10'
export LOGWATCH_OUTPUT_TYPE='unformatted'
export LOGWATCH_TEMP_DIR='/var/cache/logwatch/logwatch.sOga48bL/'
export LOGWATCH_DEBUG='10'

Preprocessing LogFile: secure
/var/log/secure  2>/dev/null | /usr/bin/perl
/usr/share/logwatch/scripts/shared/expandrepeats ''| /usr/bin/perl
/usr/share/logwatch/scripts/shared/onlyhost ''| /usr/bin/perl
/usr/share/logwatch/scripts/shared/applystddate
''>/var/cache/logwatch/logwatch.sOga48bL/secure

TimeFilter: Period is day

TimeFilter: SearchDate is (Nov  6 ..:..:..)

TimeFilter: Debug SearchDate is (Nov 6 )
DEBUG: Inside ApplyStdDate...
DEBUG: Looking For: (Nov  6 ..:..:..)

Preprocessing LogFile: messages
/var/log/messages  2>/dev/null | /usr/bin/perl
/usr/share/logwatch/scripts/shared/expandrepeats ''| /usr/bin/perl
/usr/share/logwatch/scripts/shared/removeservice 'talkd'| /usr/bin/perl
/usr/share/logwatch/scripts/shared/removeservice 'telnetd'| /usr/bin/perl
/usr/share/logwatch/scripts/shared/removeservice 'inetd'| /usr/bin/perl
/usr/share/logwatch/scripts/shared/removeservice 'nfsd'| /usr/bin/perl
/usr/share/logwatch/scripts/shared/removeservice '/sbin/mingetty'|
/usr/bin/perl /usr/share/logwatch/scripts/shared/removeservice 'netscreen'|
/usr/bin/perl /usr/share/logwatch/scripts/shared/removeservice 'netscreen'|
/usr/bin/perl /usr/share/logwatch/scripts/shared/onlyhost ''| /usr/bin/perl
/usr/share/logwatch/scripts/shared/applystddate
''>/var/cache/logwatch/logwatch.sOga48bL/messages
DEBUG: Inside RemoveService...
DEBUG: Inside RemoveService...
DEBUG: Inside RemoveService...
DEBUG: Inside RemoveService...
DEBUG: Inside RemoveService...
DEBUG: Inside RemoveService...
DEBUG: Inside RemoveService: 930 Lines In, 930 Lines Out
DEBUG: Inside RemoveService: 930 Lines In, 930 Lines Out
DEBUG: Inside RemoveService: 930 Lines In, 930 Lines Out
DEBUG: Inside RemoveService: 930 Lines In, 930 Lines Out
DEBUG: Inside RemoveService: 930 Lines In, 930 Lines Out
DEBUG: Inside RemoveService...
DEBUG: Inside RemoveService: 930 Lines In, 930 Lines Out
DEBUG: Inside RemoveService: 930 Lines In, 930 Lines Out

TimeFilter: Period is day

TimeFilter: SearchDate is ( 2010-Nov-06 ..h ..m ..s )

TimeFilter: Debug SearchDate is ( 2010-Nov-06 h m s )

################### Logwatch 7.3 (03/24/06) ####################
        Processing Initiated: Sat Nov  6 11:38:23 2010
        Date Range Processed: today
                              ( 2010-Nov-06 )
                              Period is day.
      Detail Level of Output: 10
              Type of Output: unformatted
           Logfiles for Host: valhala.xxxxxxxxxxxx.org
  ##################################################################

 --------------------- SSHD Begin ------------------------

 DEBUG: Inside OnlyService for sshd


 DEBUG: Inside SSHD Filter


 ---------------------- SSHD End -------------------------


Looking at file /usr/share/logwatch/scripts/services/sshd there is block of
code starting at line 165:

...
if ( $Debug >= 5 ) {
        print STDERR "\n\nDEBUG: Inside SSHD Filter \n\n";
        $DebugCounter = 1;
}

while (defined(my $ThisLine = <STDIN>)) {
   if ( $Debug >= 5 ) {
      print STDERR "DEBUG($DebugCounter): $ThisLine";
      $DebugCounter++;
   }
...

>From above, this line never prints anything:

print STDERR "DEBUG($DebugCounter): $ThisLine";

while the previous print STDERR does print when $Debug >= 5.

Doing a rpm -V Logwatch shows one changed file

S.5....T  c /etc/logwatch/conf/logwatch.conf

as I added a " Detail = High" line to it.

I do have sshd events in /var/log/secure, here's some showing testing a
failed login using a non-existing account:

2010-11-06T08:59:03.684006-04:00 valhala sshd[23633]: Invalid user bob from
192.168.1.12
2010-11-06T08:59:03.688784-04:00 valhala sshd[23636]:
input_userauth_request: invalid user bob
2010-11-06T08:59:05.996036-04:00 valhala sshd[23633]: pam_unix(sshd:auth):
check pass; user unknown
2010-11-06T08:59:05.996313-04:00 valhala sshd[23633]: pam_unix(sshd:auth):
authentication failure; logname= uid=0 euid=0 tty=ssh ruser=
rhost=bunny2.xxxxxxxxxxxx.org
2010-11-06T08:59:07.837697-04:00 valhala sshd[23633]: Failed password for
invalid user bob from 192.168.1.12 port 57945 ssh2
2010-11-06T08:59:10.644065-04:00 valhala sshd[23633]: pam_unix(sshd:auth):
check pass; user unknown
2010-11-06T08:59:12.505509-04:00 valhala sshd[23633]: Failed password for
invalid user bob from 192.168.1.12 port 57945 ssh2
2010-11-06T08:59:14.348019-04:00 valhala sshd[23633]: pam_unix(sshd:auth):
check pass; user unknown
2010-11-06T08:59:15.759400-04:00 valhala sshd[23633]: Failed password for
invalid user bob from 192.168.1.12 port 57945 ssh2
2010-11-06T08:59:18.315990-04:00 valhala sshd[23633]: pam_unix(sshd:auth):
check pass; user unknown
2010-11-06T08:59:19.607300-04:00 valhala sshd[23633]: Failed password for
invalid user bob from 192.168.1.12 port 57945 ssh2
2010-11-06T08:59:24.686480-04:00 valhala sshd[23636]: Connection closed by
192.168.1.12
2010-11-06T08:59:24.687107-04:00 valhala sshd[23633]: PAM 3 more
authentication failures; logname= uid=0 euid=0 tty=ssh ruser=
rhost=bunny2.xxxxxxxxxxxx.org
2010-11-06T08:59:24.687132-04:00 valhala sshd[23633]: PAM service(sshd)
ignoring max retries; 4 > 3


Does anyone have any idea why this isn't working? The only thing I see is a
date discrepancy:

TimeFilter: SearchDate is ( 2010-Nov-06 ..h ..m ..s ), vs
2010-11-06T08:59:03.684006-04:00

Thanks in advance for any clues.

Al
--
Experience varies directly with equipment ruined.