Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to compact the syslog entries from vsftpd with logwatch, to get from:

 vsftpd: pam_succeed_if(vsftpd:auth): error retrieving information about user Administrator
 vsftpd: pam_succeed_if(vsftpd:auth): error retrieving information about user Administrator
 vsftpd: pam_succeed_if(vsftpd:auth): error retrieving information about user Administrator
 vsftpd: pam_succeed_if(vsftpd:auth): error retrieving information about user Administrator
 vsftpd: pam_succeed_if(vsftpd:auth): error retrieving information about user Administrator
 ... many many times

to

vsftpd: pam_succeed_if(vsftpd:auth): error retrieving information about user Administrator : 125 time(s)

How can I do that?

share|improve this question

3 Answers 3

What version and distribution of Linux/Unix are you using and what version is logwatch? I am running Redhat 4 - logwatch 5.2.2, and in my vsftp script (/etc/log.d/scripts/services/vsftp) there is the following:

if (keys %FailedLogins) {
   print "\nFailed FTP Logins:\n";
   foreach $ThisOne (keys %FailedLogins) {
      print $ThisOne . $FailedLogins{$ThisOne} . " Time(s)\n";
   }
}

Earlier in the script it sums the failures for each user.

share|improve this answer

Upgrade logwatch. Newer logwatch scripts automatically do that.

share|improve this answer
    
Thanks for the answer. I'm running logwatch-7.3-6.el5 . Which version should I upgrade to? –  Robert Munteanu Jul 11 '09 at 11:45
    
I am also having same logwatch version. (Logwatch 7.3.6 (released 05/19/07)). But my scripts do have for each code to sum up all errors as listed in one of the answers. Try downloading latest logwatch from net in source code format. Do not use standard yum update. That should work fine. I use fedora and mine is standard package that came with fedora 11. –  Saurabh Barjatiya Jul 11 '09 at 13:17

uniq will do this for you: I don't think you can control the format, but you could easily fix that with awk.

# echo -e "two\ntwo\none\ntwo\ntwo" | uniq -c
      2 two
      1 one
      2 two

I'm assuming you don't care about timestamps, which you don't have on your examples.

share|improve this answer
    
Thanks for the answer. How would this fit in logwatch? –  Robert Munteanu Jun 11 '09 at 11:49

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.