Changeset 1584 for trunk/server/fedora/config/etc/syslog-ng/d_zroot.pl

Timestamp:

Jul 5, 2010, 2:52:23 PM (14 years ago)

Author:

geofft

Message:

d_zroot: Also punt the logic for counting failed root logins

This updates r1583, whose intent was to drop all such messages. Since we don't
permit password logins for root any more than we do for other accounts, there's
no need to zephyr about either.

File:

• trunk/server/fedora/config/etc/syslog-ng/d_zroot.pl (modified) (3 diffs)

trunk/server/fedora/config/etc/syslog-ng/d_zroot.pl

@@ -29 +29 @@
 
 my %sshkeys;
-
-my %ips;
 
 sub buildKeyMap($) {
@@ -90 +88 @@
                 sendmsg($message." (UNKNOWN KEY)");
             }
-        } elsif ($message =~ m|^Failed keyboard-interactive/pam for root from ([^ ]*)|) {
-            my $count = ++$ips{$1};
-            if ($count % 10 == 0 or $1 =~ /^18\./) {
-                sendmsg($message." (repeated $count times)", "scripts-spew");
-            }
         } elsif ($message =~ m|^Out of memory:|) {
             sendmsg($message);
@@ -107 +100 @@
         } elsif ($message =~ m|^Received disconnect from|) {
         } elsif ($message =~ m|^Postponed keyboard-interactive|) {
-        } elsif ($message =~ m|^Failed keyboard-interactive|) {
+        } elsif ($message =~ m|^Failed keyboard-interactive/pam|) {
         } elsif ($message =~ m|^fatal: Read from socket failed: Connection reset by peer$|) {
         } elsif ($message =~ m|^reverse mapping checking getaddrinfo|) {