Bug 184363 - Logwatch looks for wrong service name for cron
Logwatch looks for wrong service name for cron
Product: Red Hat Enterprise Linux 4
Classification: Red Hat
Component: logwatch (Show other bugs)
All Linux
medium Severity medium
: ---
: ---
Assigned To: Ivana Varekova
Depends On:
Blocks: 189992 FAST4.5APPROVED
  Show dependency treegraph
Reported: 2006-03-08 03:38 EST by Håvard Lygre
Modified: 2007-11-30 17:07 EST (History)
0 users

See Also:
Fixed In Version: RHBA-2006-0631
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2006-09-06 09:54:53 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Håvard Lygre 2006-03-08 03:38:56 EST
Description of problem:

Logwatch (service pam_unix) expects output from cron to begin with "cron:" while
it begins with "crond:".

This causes the following output in the daily security mails:

 --------------------- pam_unix Begin ------------------------ 

   Unknown Entries:
      session closed for user root: 170 Time(s)
      session opened for user root by (uid=0): 170 Time(s)

 ---------------------- pam_unix End ------------------------- 

Version-Release number of selected component (if applicable):

Red Hat Enterprise Linux ES release 4 (Nahant Update 3)

How reproducible:

Run logwatch on a system which runs cron-jobs.

Actual results:

Output as above.

Expected results:

No output.

Additional info:

Simple fix.

--- pam_unix.old        2006-03-08 09:41:56.000000000 +0100
+++ pam_unix    2006-03-08 09:42:02.000000000 +0100
@@ -133,7 +133,7 @@
       if ($line =~ s/^authentication failure; .*uid=(\d+) euid=(\d+) tty=(.+)
ruser= rhost=  user=(.+)$/$4($1,$2) on display $3/) {
          $data{$service}{'Authentication Failures'}{$line}++;
-   } elsif ($service eq 'cron') {
+   } elsif ($service eq 'crond') {
           if ($line =~ s/^session opened for user (.+) by \(uid=\d+\)/$1/) {
                   ($Detail >= 5) && $data{$service}{'Sessions Opened'}{$line}++;
           } elsif ($line =~ /session closed for user/) {
Comment 3 Ivana Varekova 2006-04-27 09:50:05 EDT
Thank you for your bug report.
The fixed version is on
Could you please test this version?
There are fixed other 5 bugs (the complete list of fixed bugs is on
Comment 8 Red Hat Bugzilla 2006-09-06 09:54:54 EDT
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.


Note You need to log in before you can comment on or make changes to this bug.