CheckAuthLog Change Log: Difference between revisions
Jump to navigation
Jump to search
No edit summary |
No edit summary |
||
| Line 7: | Line 7: | ||
Version 2.0.0 includes performance improvements for the log file parsing and a mechanism to avoid more than one instance running at a time. Also support is included for Exim. As I do not run Exim that code has only been lightly tested. Feedback is welcome. | Version 2.0.0 includes performance improvements for the log file parsing and a mechanism to avoid more than one instance running at a time. Also support is included for Exim. As I do not run Exim that code has only been lightly tested. Feedback is welcome. | ||
Version 3.0.0 released 11 April 2015 contains the following main changes: | Version 3.0.0 released 11 April 2015 contains the following main changes: | ||
Support for syslog (enabled by default) | * Support for syslog (enabled by default) | ||
Support for log level (for syslog and for standard output) | * Support for log level (for syslog and for standard output) | ||
New configuration variable ignored_users to avoid listed users being subject to checks. Comma separated list of logins | * New configuration variable ignored_users to avoid listed users being subject to checks. Comma separated list of logins | ||
New configuration variable ignored_ips to avoid logging listed ips or ranges. Comma separated list of ips or cidr ranges. | * New configuration variable ignored_ips to avoid logging listed ips or ranges. Comma separated list of ips or cidr ranges. | ||
Ability to notify users their account has been blocked (only useful if the block does not prevent them receiving and reading email) | * Ability to notify users their account has been blocked (only useful if the block does not prevent them receiving and reading email) | ||
Self checking: the script notifies you if it fails to find new log lines after a certain interval (default 1 hour) or new logins after a certain interval (default 1 day - but should be customized to what you expect) | * Self checking: the script notifies you if it fails to find new log lines after a certain interval (default 1 hour) or new logins after a certain interval (default 1 day - but should be customized to what you expect) | ||
Self checking is enabled by default but can be turned off if not needed. | * Self checking is enabled by default but can be turned off if not needed. | ||
Support for sending self check notifications to the admin via email (not really needed if you run from crontab since you receive the standard output anyway) but for some might be useful | * Support for sending self check notifications to the admin via email (not really needed if you run from crontab since you receive the standard output anyway) but for some might be useful | ||
A new variable that can be used in mysql queries %l (lower case L) which matches the local part of the user name before the @ | * A new variable that can be used in mysql queries %l (lower case L) which matches the local part of the user name before the @ | ||
New command line options: | New command line options: | ||
-z will run the self check routines only | * -z will run the self check routines only | ||
-e [email protected] will simulate the email notification to user specified in the parameter. This can be useful for testing the email setup, without having to trigger a hit on the user or ip limits. | * -e [email protected] will simulate the email notification to user specified in the parameter. This can be useful for testing the email setup, without having to trigger a hit on the user or ip limits. | ||
A bug was found and corrected during testing of version 3 (present in previous versions). If the log file contains multiple login lines that cause the ip or message limits to be exceeded, then each single login line processed would trigger the blocking action. This can logically occur only in the same or next log file, since following the successful blocking action, no new login lines will be generated until the account is unblocked. This did not create any particular negative consequences (reblocking a blocked user), but with the email notification feature, it would have created multiple notifications. Now the script will suppress blocking action if the user was already blocked in the current or previous run. | * A bug was found and corrected during testing of version 3 (present in previous versions). If the log file contains multiple login lines that cause the ip or message limits to be exceeded, then each single login line processed would trigger the blocking action. This can logically occur only in the same or next log file, since following the successful blocking action, no new login lines will be generated until the account is unblocked. This did not create any particular negative consequences (reblocking a blocked user), but with the email notification feature, it would have created multiple notifications. Now the script will suppress blocking action if the user was already blocked in the current or previous run. | ||
Some of the development in version 3 was funded by a donation. | Some of the development in version 3 was funded by a donation. | ||
Revision as of 17:57, 13 June 2016
2010-Oct-27 check_auth_log-1.0.1.tgz
2010-Sep-19 check_auth_log-1.0.0.tgz
Version 2.0.0 includes performance improvements for the log file parsing and a mechanism to avoid more than one instance running at a time. Also support is included for Exim. As I do not run Exim that code has only been lightly tested. Feedback is welcome. Version 3.0.0 released 11 April 2015 contains the following main changes:
- Support for syslog (enabled by default)
- Support for log level (for syslog and for standard output)
- New configuration variable ignored_users to avoid listed users being subject to checks. Comma separated list of logins
- New configuration variable ignored_ips to avoid logging listed ips or ranges. Comma separated list of ips or cidr ranges.
- Ability to notify users their account has been blocked (only useful if the block does not prevent them receiving and reading email)
- Self checking: the script notifies you if it fails to find new log lines after a certain interval (default 1 hour) or new logins after a certain interval (default 1 day - but should be customized to what you expect)
- Self checking is enabled by default but can be turned off if not needed.
- Support for sending self check notifications to the admin via email (not really needed if you run from crontab since you receive the standard output anyway) but for some might be useful
- A new variable that can be used in mysql queries %l (lower case L) which matches the local part of the user name before the @
New command line options:
- -z will run the self check routines only
- -e [email protected] will simulate the email notification to user specified in the parameter. This can be useful for testing the email setup, without having to trigger a hit on the user or ip limits.
- A bug was found and corrected during testing of version 3 (present in previous versions). If the log file contains multiple login lines that cause the ip or message limits to be exceeded, then each single login line processed would trigger the blocking action. This can logically occur only in the same or next log file, since following the successful blocking action, no new login lines will be generated until the account is unblocked. This did not create any particular negative consequences (reblocking a blocked user), but with the email notification feature, it would have created multiple notifications. Now the script will suppress blocking action if the user was already blocked in the current or previous run.
Some of the development in version 3 was funded by a donation.