3

I'm trying to compact the syslog entries from vsftpd with logwatch, to get from:

 vsftpd: pam_succeed_if(vsftpd:auth): error retrieving information about user Administrator
 vsftpd: pam_succeed_if(vsftpd:auth): error retrieving information about user Administrator
 vsftpd: pam_succeed_if(vsftpd:auth): error retrieving information about user Administrator
 vsftpd: pam_succeed_if(vsftpd:auth): error retrieving information about user Administrator
 vsftpd: pam_succeed_if(vsftpd:auth): error retrieving information about user Administrator
 ... many many times

to

vsftpd: pam_succeed_if(vsftpd:auth): error retrieving information about user Administrator : 125 time(s)

How can I do that?

Robert Munteanu
  • 1,644
  • 5
  • 23
  • 41

3 Answers3

1

What version and distribution of Linux/Unix are you using and what version is logwatch? I am running Redhat 4 - logwatch 5.2.2, and in my vsftp script (/etc/log.d/scripts/services/vsftp) there is the following:

if (keys %FailedLogins) {
   print "\nFailed FTP Logins:\n";
   foreach $ThisOne (keys %FailedLogins) {
      print $ThisOne . $FailedLogins{$ThisOne} . " Time(s)\n";
   }
}

Earlier in the script it sums the failures for each user.

Swoogan
  • 2,087
  • 1
  • 14
  • 21
1

Upgrade logwatch. Newer logwatch scripts automatically do that.

Saurabh Barjatiya
  • 4,703
  • 2
  • 30
  • 34
  • Thanks for the answer. I'm running logwatch-7.3-6.el5 . Which version should I upgrade to? – Robert Munteanu Jul 11 '09 at 11:45
  • I am also having same logwatch version. (Logwatch 7.3.6 (released 05/19/07)). But my scripts do have for each code to sum up all errors as listed in one of the answers. Try downloading latest logwatch from net in source code format. Do not use standard yum update. That should work fine. I use fedora and mine is standard package that came with fedora 11. – Saurabh Barjatiya Jul 11 '09 at 13:17
0

uniq will do this for you: I don't think you can control the format, but you could easily fix that with awk.

# echo -e "two\ntwo\none\ntwo\ntwo" | uniq -c
      2 two
      1 one
      2 two

I'm assuming you don't care about timestamps, which you don't have on your examples.

David Pashley
  • 23,497
  • 2
  • 46
  • 73