Bug 104662

Summary:	logwatch missing sshd entries
Product:	[Retired] Red Hat Linux	Reporter:	Paul Rensing <prensing>
Component:	logwatch	Assignee:	Elliot Lee <sopwith>
Status:	CLOSED DUPLICATE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	8.0	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	i686
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2006-02-21 18:58:37 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Paul Rensing 2003-09-18 16:11:01 UTC

From Bugzilla Helper:
User-Agent: Mozilla/5.0 Galeon/1.2.11 (X11; Linux i686; U;) Gecko/20030417

Description of problem:
logwatch is missing all the SSHD messages. After a little debugging, I
discovered that the problem is that it is running the filter removeheaders
*before* the filter "onlyservice sshd". Then, the SSHD filter gets no lines.

I tried to diagnose this further but have not gotten anywhere yet.


Version-Release number of selected component (if applicable):
logwatch-2.6-8

How reproducible:
Always

Steps to Reproduce:
1. Run "/etc/cron.daily/00-logwatch  --print --service sshd --detail high
--debug 1000"
2. Look at the output (near the end) and you will see that removeheader was run
first.

Additional info:

Comment 1 Paul Rensing 2003-09-18 16:13:06 UTC

Oops. Sorry, I submitted this twice.

*** This bug has been marked as a duplicate of 104658 ***

Comment 2 Red Hat Bugzilla 2006-02-21 18:58:37 UTC

Changed to 'CLOSED' state since 'RESOLVED' has been deprecated.