Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I am using SSLH on my server to accept both SSL and SSH connections on Port 443.

As the logs of sshd and apache2 show each incoming connection via SSLH originating from 127.0.0.1, I want to add the log of SSLH to Logwatch.

To achieve this, I first filtered all entries regarding sslh into a seperate logfile with the following code in /etc/rsyslog.d/sslh.conf:

if $programname == 'sslh' then /var/log/sslh.log
if $programname == 'sslh' then ~

In the file /etc/logwatch/conf/logfiles/sslh.conf I added this to tell Logwatch about the logfile:

LogFile = /var/log/sslh.log
LogFile = /var/log/sslh.log.0
Archive = /var/log/sslh.log.*.gz

*ApplyStdDate =

The service definition in /etc/logwatch/conf/services/sslh.conf looks like this:

Title = "SSLH SSH / HTTPS Multiplexer"
LogFile = sslh

At last, I added the service script /etc/logwatch/scripts/services/sslh with this content:

#!/bin/bash

echo "Date Range: $LOGWATCH_DATE_RANGE"
echo "Detail Level: $LOGWATCH_DETAIL_LEVEL"
echo "Temp Dir: $LOGWATCH_TEMP_DIR"
echo "Debug Level: $LOGWATCH_DEBUG"

grep -v 'forwarded to SSL$'

When I run Logwatch with the service sslh explicitly specified, everything works like a charm and I get the filtered output for the desired timespan:

logwatch --service sslh --output stdout

################### Logwatch 7.4.0 (05/02/12) ####################
       Processing Initiated: Fri Jul 12 11:37:46 2013
       […]
##################################################################

--------------------- SSLH SSH / HTTPS Multiplexer Begin ------------------------

Jul 11 22:51:13 example sslh[2225]: connection from […].adsl.alicedsl.de:3643 to […].yourvserver.net:https forwarded from localhost:59788 to localhost:https
Jul 11 22:51:13 example sslh[2225]: connection from […].adsl.alicedsl.de:3644 to […].yourvserver.net:https forwarded from localhost:59789 to localhost:https
[…]

---------------------- SSLH SSH / HTTPS Multiplexer End -------------------------


###################### Logwatch End #########################

The problem occurs in regular operation, when calling Logwatch like this:

logwatch --mailto webmaster@example.com

I redirected the output of Logwatch into a file and found some strange lines like this one for example, where sslh is listed as disabled:

Service List:
[0] = all
[1] = -zz-network
[2] = -zz-sys
[3] = -eximstats
[4] = -sslh

Grepping for sslh in the Logwatch output produced this:

root:~# grep -r -i -n sslh ~/logwatch_out

38:[4] = -sslh
75:[4] = -sslh
4747:ReadConfigFile: Opening /etc/logwatch/conf/services/sslh.conf
4748:ReadConfigFile: Read Line: Title = "SSLH SSH / HTTPS Multiplexer"
4749:ReadConfigFile: Name=Title, Value="SSLH SSH / HTTPS Multiplexer"
4750:ReadConfigFile: Read Line: LogFile = sslhReadConfigFile: Name=LogFile, Value=sslh
6431:ReadConfigFile: Opening /etc/logwatch/conf/logfiles/sslh.conf
6432:ReadConfigFile: Read Line: LogFile = /var/log/sslh.log
6433:ReadConfigFile: Name=LogFile, Value=/var/log/sslh.log
6434:ReadConfigFile: Read Line: LogFile = /var/log/sslh.log.0
6435:ReadConfigFile: Name=LogFile, Value=/var/log/sslh.log.0
6436:ReadConfigFile: Read Line: Archive = /var/log/sslh.log.*.gz
6437:ReadConfigFile: Name=Archive, Value=/var/log/sslh.log.*.gz
6527:[85] = sslh
6594:[47] = sslh
6867:Service Name: sslh
6868:   Logfile = sslh
7181:Logfile Name: sslh
7183:   Logfile = /var/log/sslh.log

After figuring out that my configuration for Logwatch regarding sslh works, when I specify the service sslh explicitly, I have absolutely no idea, why sslh is excluded when running Logwatch regulary.

Even the category "SSLH" is not included in the E-Mail, with or without any content.

Any help would be appreciated.

share|improve this question
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.