diff mbox series

logwatch: Adjust the syslogd and dhcpd services to fix firewall summary

Message ID 20261023162830.4054181-1-adolf.belka@ipfire.org
State New
Headers
Series logwatch: Adjust the syslogd and dhcpd services to fix firewall summary |

Commit Message

Adolf Belka 23 Oct 2026, 4:28 p.m. UTC 
- In the IPFire firewall summary that is shown on a daily basis, there are lines included
   from syslod and dhcpd that are not needed to be shown.
- With syslogd every time a restart is carried out there are also lines related to the
   socket removal, creation & opening for port 514. These lines were always being shown
   as ***Unmatched entries***. This patch now filters them and does not display them when
   the restart is shown.
- With dhcpd there were a lot of execute_statement_argv[x] entries being shown as
   ***Unknown Entries***. These are not needed to be shown as the process already shows
   dhcp lease requests. This patch now filters them and does not display them.
- This has been done via a patch of the source tarball rather than copying the files
   into /usr/share/logwatch/scripts/services/ or /etc/logwatch/scripts/services/. Both
   of these approaches would mean that any updates of the service file from the logwatch
   developers would not end up being used as they would be overwritten. The patch only
   adds the changes into the provided logwatch service files, so any improvements will
   be included in any updates.

Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 lfs/logwatch                                  |  2 ++
 ...tement_argv_lines_from_dhcpd_service.patch | 13 +++++++++++
 ...ve_socket_lines_from_syslogd_service.patch | 23 +++++++++++++++++++
 3 files changed, 38 insertions(+)
 create mode 100644 src/patches/logwatch/logwatch-7.15-remove_execute_statement_argv_lines_from_dhcpd_service.patch
 create mode 100644 src/patches/logwatch/logwatch-7.15-remove_socket_lines_from_syslogd_service.patch
diff mbox series

Patch

diff --git a/lfs/logwatch b/lfs/logwatch
index cbfa139f1..6fa644341 100644
--- a/lfs/logwatch
+++ b/lfs/logwatch
@@ -76,6 +76,8 @@  $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/logwatch/logwatch-7.11-disable_iptables.patch
 	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/logwatch/logwatch-7.11-enable-mdadm-sudo.patch
 	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/logwatch/logwatch-7.15-Revert_sbin_to_bin_change.patch
+	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/logwatch/logwatch-7.15-remove_execute_statement_argv_lines_from_dhcpd_service.patch
+	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/logwatch/logwatch-7.15-remove_socket_lines_from_syslogd_service.patch
 
 	@cd $(DIR_APP) && chmod 755 install_logwatch.sh
 	cd $(DIR_APP) && yes "" | ./install_logwatch.sh
diff --git a/src/patches/logwatch/logwatch-7.15-remove_execute_statement_argv_lines_from_dhcpd_service.patch b/src/patches/logwatch/logwatch-7.15-remove_execute_statement_argv_lines_from_dhcpd_service.patch
new file mode 100644
index 000000000..d275dddf3
--- /dev/null
+++ b/src/patches/logwatch/logwatch-7.15-remove_execute_statement_argv_lines_from_dhcpd_service.patch
@@ -0,0 +1,13 @@ 
+--- logwatch-7.15/scripts/services/dhcpd.orig	2026-10-20 17:37:26.280004330 +0200
++++ logwatch-7.15/scripts/services/dhcpd	2026-10-22 12:11:47.720231072 +0200
+@@ -259,6 +259,10 @@
+       $data{'Late or spurious Echo Reply for'}{$1}++;
+    } elsif ($line =~ /^ICMP Echo reply while lease ([\da-fA-F\.:]+) valid/) {
+       $data{'Echo reply while lease valid'}{$1}++;
++   } elsif ($line =~ /^execute_statement argv\[\d+\] =/) {
++      # Do nothing
++   } elsif ($line eq 'execute: /usr/sbin/dhcp-lease exit status 512') {
++      # Do nothing
+    } else {
+       $data{'Unknown Entries'}{$line}++;
+    }
diff --git a/src/patches/logwatch/logwatch-7.15-remove_socket_lines_from_syslogd_service.patch b/src/patches/logwatch/logwatch-7.15-remove_socket_lines_from_syslogd_service.patch
new file mode 100644
index 000000000..516c5ae25
--- /dev/null
+++ b/src/patches/logwatch/logwatch-7.15-remove_socket_lines_from_syslogd_service.patch
@@ -0,0 +1,23 @@ 
+--- logwatch-7.15/scripts/services/syslogd.orig	2026-10-20 17:37:26.190001574 +0200
++++ logwatch-7.15/scripts/services/syslogd	2026-10-22 12:12:08.963750264 +0200
+@@ -27,7 +27,7 @@
+ my $Detail = $ENV{'LOGWATCH_DETAIL_LEVEL'} || 0;
+ 
+ #Init Counters
+-my $Kills=  my $Starts=     my $Errors=
++my $Kills=  my $Starts=  my $Errors= 
+ 0;
+ 
+ #Init Hashes
+@@ -49,6 +49,11 @@
+    elsif ($ThisLine =~ /^Cannot glue message parts together$/) {
+       $Errors++;
+    }
++   elsif ($ThisLine eq 'Opened inet socket *:514' ||
++	   $ThisLine eq 'Closing inet socket *:514' ||
++	   $ThisLine eq 'Created UNIX socket /dev/log') {
++      # Do nothing
++   }
+    else {
+       # Report any unmatched entries...
+       $OtherList{$ThisLine}++;