What does this mean

[lonetwin]

Thanks Allen.

Your info really helped :-)

On Fri, Jul 11, 2008 at 11:15 PM, Allen, Jack <Jack.Allen at mckesson.com>
wrote:

> All:
>        After some research I was able to determine what the problem was and
> how to correct it. In /var/log/up2date the following entries are written
> each time up2date connects to RHN to check for updates:
>
> [Fri Jul 11 11:58:34 2008] up2date updateLoginInfo() login info
> [Fri Jul 11 11:58:34 2008] up2date logging into up2date server
> [Fri Jul 11 11:58:35 2008] up2date successfully retrieved authentication
> token from up2date server
>
>        In /usr/share/logwatch/scripts/services/up2date the following perl
> code checks for some entries to ignore:
>
> if ( ( $ThisLine =~ /^updating login info$/ ) or
>     ( $ThisLine =~ /^Opening rpmdb in \/var\/lib\/rpm\/ with option .$/ )
> or
>     ( $ThisLine =~ /^successfully retrieved authentication token from
> up2date server$/ ) or
>        AND MORE COMPARES
>
>        As you can see the first compare is looking for a line indicating
> the login information has been updated. Evidently the message has been
> changed and so it does not match. So I copied the file to
> /etc/logwatch/scripts/services/up2date and added another compare as follows:
>
> if ( ( $ThisLine =~ /^updating login info$/ ) or
>     ( $ThisLine =~ /^updateLoginInfo\(\) login info/ ) or
>     ( $ThisLine =~ /^Opening rpmdb in \/var\/lib\/rpm\/ with option .$/ )
> or
>     ( $ThisLine =~ /^successfully retrieved authentication token from
> up2date server$/ ) or
>
>        By copying the up2date file to the new location and adding my change
> there, it will be used when logwatch runs, because that is the way it is
> designed to function. Also if there is a update to logwatch it will not
> clobber my change. And after an update I can just rename the file and see if
> the update fixed this problem along with what ever else it fixed.
>
> Thanks:
> Jack Allen
>
> -----Original Message-----
> From: redhat-list-bounces at redhat.com [mailto:
> redhat-list-bounces at redhat.com] On Behalf Of Florez, Nestor
> Sent: Thursday, July 10, 2008 2:46 PM
> To: General Red Hat Linux discussion list
> Subject: RE: What does this mean
>
> No, I never got the information on how to ignore it, I just chose to ignore
> it.  Sorry :-(
>
> Nestor :-)
>
> -----Original Message-----
> From: redhat-list-bounces at redhat.com
> [mailto:redhat-list-bounces at redhat.com]On Behalf Of Allen, Jack
> Sent: Thursday, July 10, 2008 11:40 AM
> To: General Red Hat Linux discussion list
> Subject: RE: What does this mean
>
>
> Nestor:
>        Did you get the information on how to ignore the entries in
> logwatch?
>
>        If so, can you provide it.
>
>        Another thing about logwatch is in RH AS 4.X it would log most all
> services started by xinetd, but in RH EL 5.X it does not. So I assume there
> is some configuration parameter somewhere that may control this. I would
> like to have that information again because it helps to see if there has
> been some kind of port scan done on the system.
>
> Thanks:
> Jack Allen
>
> -----Original Message-----
> From: redhat-list-bounces at redhat.com [mailto:
> redhat-list-bounces at redhat.com] On Behalf Of Florez, Nestor
> Sent: Thursday, July 10, 2008 2:19 PM
> To: General Red Hat Linux discussion list
> Subject: RE: What does this mean
>
> I opened a ticket (case# 1832642) because of this problem and this
> is the response I got from rhel:
> -------------
> I tried to reproduce this problem here on test machines.
>
> There is nothing wrong with the yum, but there is problem with the log
> filtering by logwatch.
>
> You can ignore these messages in the logwatch report, also there is way
> with which we can ignore these messages in the logwatch report.
>
> Please let us know if you want to ignore these log entries from the
> logwatch report.
>
> Thanks & Regards,
> Rajmani
> ------------
>
> Néstor :-)
>
> -----Original Message-----
> From: redhat-list-bounces at redhat.com
> [mailto:redhat-list-bounces at redhat.com]On Behalf Of Shaun Meyer
> Sent: Thursday, July 10, 2008 11:13 AM
> To: General Red Hat Linux discussion list
> Subject: Re: What does this mean
>
>
> Hi,
>
> On Thu, July 10, 2008 12:57 pm, Allen, Jack wrote:
> > Hello:
> >         I get the following every day from Logwatch. I am running RedHat
> > EL 5.2.
> >
> > Does this indicate there is a problem?
> > Or is it just general information?
> >
>
> >  --------------------- up2date Begin ------------------------
> >
> >  **Unmatched Entries**
> >  updateLoginInfo() login info
> >  updateLoginInfo() login info
> >  updateLoginInfo() login info
> >  updateLoginInfo() login info
> >  updateLoginInfo() login info
> >  updateLoginInfo() login info
> >  updateLoginInfo() login info
> >  updateLoginInfo() login info
> >  updateLoginInfo() login info
> >  updateLoginInfo() login info
> >  updateLoginInfo() login info
> >  updateLoginInfo() login info
> >  updateLoginInfo() login info
> >  updateLoginInfo() login info
> >
> >  ---------------------- up2date End -------------------------
> >
> > ---
> > Thanks:
> > Jack Allen
>
>
> I 've been getting this same message, are you using/have enabled RPMforge?
>
> Cheers,
> Shaun
>
> --
> redhat-list mailing list
> unsubscribe mailto:redhat-list-request at redhat.com?subject=unsubscribe
> https://www.redhat.com/mailman/listinfo/redhat-list
>
> --
> redhat-list mailing list
> unsubscribe mailto:redhat-list-request at redhat.com?subject=unsubscribe
> https://www.redhat.com/mailman/listinfo/redhat-list
>
> --
> redhat-list mailing list
> unsubscribe mailto:redhat-list-request at redhat.com?subject=unsubscribe
> https://www.redhat.com/mailman/listinfo/redhat-list
>
> --
> redhat-list mailing list
> unsubscribe mailto:redhat-list-request at redhat.com?subject=unsubscribe
> https://www.redhat.com/mailman/listinfo/redhat-list
>
> --
> redhat-list mailing list
> unsubscribe mailto:redhat-list-request at redhat.com?subject=unsubscribe
> https://www.redhat.com/mailman/listinfo/redhat-list
>