Bug 867290

Description of problem:
Logwatch is misparsing userhelper log entries for hddtemp that specify a device using a name that includes a slash. Running '/usr/sbin/hddtemp -n -q /dev/sda' produces in '/var/log/secure' lines like the following:

**********
Oct 12 22:35:40 archer userhelper[17819]: running '/usr/sbin/hddtemp -n -q /dev/sda' with root privileges on behalf of 'major'
**********

Logwatch reports the following in the 'Connections (secure-log)' section:

**********
 Userhelper executed applications:
    major -> sda as root:  1 Time(s)
**********

It should be:

**********
 Userhelper executed applications:
    major -> hddtemp as root:  1 Time(s)
**********


The logwatch script '/usr/share/logwatch/scripts/services/secure' parses the '/var/log/secure' entry using the pattern

**********
($ThisLine =~ /^userhelper\[\d+\]: running '([^']+)' with ([^']+) privileges on behalf of '([^']+)'/)
**********

which produces in my example the three strings '/usr/sbin/hddtemp -n -q /dev/sda', 'root', and 'major', later in the script called 'longapp', 'asuser', and 'user' and parsed using the following code:

**********
if (keys %Executed_app) {
   print "\nUserhelper executed applications:\n";
   foreach (keys %Executed_app) {
     ($longapp,$asuser,$user) = split ",";
     $app = substr($longapp,rindex($longapp,"/")+1);
     print "   $user -> $app as $asuser:  ".$Executed_app{"$longapp,$asuser,$user"}." Time(s)\n";
   }
}
**********

The 'longapp' string '/usr/sbin/hddtemp -n -q /dev/sda' is converted to the 'app' string by taking the substring following the last slash, which erroneously gives 'sda'. The 'app' string value should be 'hddtemp', not 'sda'.


Version-Release number of selected component (if applicable):
logwatch-7.4.0-17.20120619svn110.fc17.noarch

How reproducible:
Use the command '/usr/sbin/hddtemp -n -q /dev/sda' or some hddtemp command that includes a trailing device name that has a slash in it to produce an entry in '/var/log/secure' and let logwatch analyze it. (The particular hddtemp command that I have been using is actually run as part of a graphical temperature sensor widget.)