LICENSE_FILE=	${WRKSRC}/LICENSE

BUILD_DEPENDS=	docbook-to-man>0:textproc/docbook-to-man

	docbook-to-man ${WRKSRC}/docs/logcheck.sgml > ${WRKSRC}/docs/logcheck.8

	${FIND} ${WRKSRC} -type f \( -name \*.orig -o -name \*.bak \) -delete

	${INSTALL_SCRIPT} ${WRKSRC}/src/logcheck-test ${STAGEDIR}${PREFIX}/bin

--- debian/logcheck.cron.d.orig	2017-01-25 21:08:04 UTC

+++ debian/logcheck.cron.d

@@ -1,9 +1,5 @@

-# /etc/cron.d/logcheck: crontab entries for the logcheck package

-

-PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

+# crontab entries for the logcheck package

+PATH=/sbin:/bin:/usr/sbin:/usr/bin:%%PREFIX%%/sbin:%%PREFIX%%/bin

 MAILTO=root

-

-@reboot         logcheck    if [ -x /usr/sbin/logcheck ]; then nice -n10 /usr/sbin/logcheck -R; fi

-2 * * * *       logcheck    if [ -x /usr/sbin/logcheck ]; then nice -n10 /usr/sbin/logcheck; fi

-

-# EOF

+@reboot    if [ -x %%PREFIX%%/sbin/logcheck ]; then nice -n10 %%PREFIX%%/sbin/logcheck -R; fi

+2 * * * *  if [ -x %%PREFIX%%/sbin/logcheck ]; then nice -n10 %%PREFIX%%/sbin/logcheck; fi

--- docs/README.logcheck.orig	2017-01-25 21:08:04 UTC

+++ docs/README.logcheck

@@ -17,11 +17,11 @@ don't start overlapping.

 ======================================================================

 LOG ENTRIES

 -----------

-These are taken from a specified set of logfiles (usually syslog and

+These are taken from a specified set of logfiles (usually messages and

 auth.log); a special Perl utility named "logtail" is used which

 "bookmarks" its place in the logs, so that events aren't reported

 twice in successive logcheck runs.  The offset records are stored as

-(eg) "/var/lib/logcheck/offset.var.log.syslog"; lines to be

+(eg) "%%DBDIR%%/offset.var.log.messages"; lines to be

 considered by logcheck are copied into tempfiles in the working

 directory "/var/tmp/logcheck".  See the corresponding README for

 logtail for further notes on complications such as log-rotation.

--- docs/README.logcheck-database.orig	2017-01-25 21:08:04 UTC

+++ docs/README.logcheck-database

@@ -15,7 +15,7 @@ normal egrep pattern-matches, applied in

 1. the "SECURITY ALERTS" layer, designed to detect the traces of active

 	intrusion attempts.

-   Patterns raising the alarm go in "/etc/logcheck/cracking.d"; any

+   Patterns raising the alarm go in "%%ETCDIR%%/cracking.d"; any

 	event that matches one of these patterns turns the report

 	into an urgent "Security Alerts" report, with the relevant

 	event moved to a special section.  The cracking.d standard

@@ -26,7 +26,7 @@ normal egrep pattern-matches, applied in

 	the default logcheck configuration, but if the local

 	administrator enables this layer of filtering in

 	logcheck.conf, then the rules go in the directory

-	"/etc/logcheck/cracking.ignore.d".  Matches with

+	"%%ETCDIR%%/cracking.ignore.d".  Matches with

 	cracking.ignore rules will then reclassify the alert as a

 	false alarm (compare violations.ignore below).  Note that

 	this means they are totally ignored - log messages handled

@@ -35,12 +35,12 @@ normal egrep pattern-matches, applied in

 2. the "SECURITY EVENTS" layer, designed to detect less critical

 	events still considered worthy of special attention.

-   Patterns raising the alarm go in "/etc/logcheck/violations.d";

+   Patterns raising the alarm go in "%%ETCDIR%%/violations.d";

 	matches with these result in a "Security Events" alert,

 	with the relevant event moved to a special section.

    Patterns cancelling such alarms go in the standard directory

-	"/etc/logcheck/violations.ignore.d"; apparent "Security

+	"%%ETCDIR%%/violations.ignore.d"; apparent "Security

 	Events" that match with violations.ignore patterns are

 	discarded as false alarms.

@@ -51,7 +51,7 @@ normal egrep pattern-matches, applied in

 	from the logfiles are considered for inclusion in the main

 	"System Events" section.

-   Patterns in the three "/etc/logcheck/ignore.d.*" directories

+   Patterns in the three "%%ETCDIR%%/ignore.d.*" directories

 	again function to overrule alerts; the log messages that

 	match them are excluded from the report as trivial.  The

 	specific directories consulted depend on the prevailing

@@ -78,13 +78,13 @@ underscore, and hyphen.

 Contains filters relevant to only one Debian package - for example

 if "fooserver" logs suspicious events like this:

 "$DATE $HOSTNAME fooserver[$PID]: $USER is up to no good"

-then a line in "/etc/logcheck/violations.d/fooserver" with an

+then a line in "%%ETCDIR%%/violations.d/fooserver" with an

 appropriate pattern will promote it from a mere "System Event"

 to a full "Security Event" in a subsection of the mailing headed

 "fooserver".  Or then again if that kind of log message is more

 trivial than it looks (maybe "foo" is a networked game of

 spy-and-counterspy) then a line in

-"/etc/logcheck/ignore.d.server/fooserver" will turn it into a

+"%%ETCDIR%%/ignore.d.server/fooserver" will turn it into a

 nonevent for all but the most assiduous of administrators.

 Sometimes a package will have not only special alarm calls which

@@ -107,7 +107,7 @@ that need to be processed.

 Standard "generic" rules go in each directory's "./logcheck" file;

 thus for instance any log message at all matching "ATTACK"

-(listed in "/etc/logcheck/cracking.d/logcheck") _always_ triggers

+(listed in "%%ETCDIR%%/cracking.d/logcheck") _always_ triggers

 a "Security Alert", unless you deliberately tamper with

 "cracking.ignore.d" rules.

@@ -122,12 +122,12 @@ non-package-specific "flagging" patterns

 "fooserver" outputs syslog messages like this:

     "$DATE $HOSTNAME fooserver[$PID]: 3 attempts 0 rejected"

 then the standard keyword "reject" listed in the generic

-"/etc/logcheck/violations.d/logcheck" file will trigger frequent

+"%%ETCDIR%%/violations.d/logcheck" file will trigger frequent

 "Security Events" reports.  Putting a filtering pattern in

-"/etc/logcheck/violations.ignore.d/fooserver" won't help here!

+"%%ETCDIR%%/violations.ignore.d/fooserver" won't help here!

 The solution is to use a file named in the specially-privileged

 ./logcheck-<packagename> format:

-"/etc/logcheck/violations.ignore.d/logcheck-fooserver".

+"%%ETCDIR%%/violations.ignore.d/logcheck-fooserver".

 This can contain patterns provided by that particular package

 which nonetheless need to take precedence over the generic rules.

@@ -137,8 +137,8 @@ Sysadmins can use the "local-*" filename

 additions to the "logcheck-*" pattern lists.  If you have "ippl"

 logging network connections verbosely into syslog then you can put

 custom "Security Events" keywords in

-"/etc/logcheck/violations.d/local-ippl" and exceptions in

-"/etc/logcheck/violations.ignore.d/local-ippl".

+"%%ETCDIR%%/violations.d/local-ippl" and exceptions in

+"%%ETCDIR%%/violations.ignore.d/local-ippl".

 WRITING RULES

@@ -181,7 +181,7 @@ logcheck-test(1)).

 Alternatively you can manually grep your log file, and remove trailing

 space with something like this:

-    sed -e 's/[[:space:]]*$//' /var/log/syslog | egrep \

+    sed -e 's/[[:space:]]*$//' /var/log/messages | egrep \

     '^\w{3} [ :0-9]{11} oempc wwwoffled\[[0-9]+\]: WWWOFFLE (On|Off)line\.$'

 If the log line is displayed, then your regex works.

--- docs/README.logtail.orig	2017-01-25 21:08:04 UTC

+++ docs/README.logtail

@@ -28,7 +28,7 @@ Logtail2, a different executeable, also 

 guessing a file name that might have been the target of log rotation

 and printing that file's contents starting with the stored offset. If

 you have a non-standard rotation scheme, you can drop your own

-heuristic into /usr/share/logtail/detectrotate/ and have it

+heuristic into %%DATADIR%%/detectrotate/ and have it

 automatically picked up by logtail2.

 ======================================================================

 COMMANDLINE ARGUMENTS

--- docs/logcheck-test.1.orig	2017-01-25 21:08:04 UTC

+++ docs/logcheck-test.1

@@ -38,8 +38,8 @@ Show usage information

 .B \-a, \-\-auth.log

 Parse /var/log/auth.log for matching lines

 .TP

-.B \-s, \-\-syslog

-Parse /var/log/syslog for matching lines

+.B \-m, \-\-messages

+Parse /var/log/messages for matching lines

 .TP

 .B \-l, \-\-log\-file FILE

 Parse FILE for matching lines

@@ -69,10 +69,10 @@ With

 .B logcheck-test

 you can easily write and test new rules.

 .PP

-Test a single rule against /var/log/syslog:

+Test a single rule against /var/log/messages:

 .RS

 .fam C

-logcheck-test \-s "RULE"

+logcheck-test \-m "RULE"

 .fam T

 .RE

--- docs/logcheck.sgml.orig	2017-01-25 21:08:04 UTC

+++ docs/logcheck.sgml

@@ -244,10 +244,10 @@ manpage.1: manpage.sgml

   <refsect1>

     <title>FILES</title>

-    <para>/etc/logcheck/logcheck.conf is the main configuration file.</para>

-    <para>/etc/logcheck/logcheck.logfiles is the list of files to monitor.</para>

-    <para>/etc/logcheck/logcheck.logfiles.d is the directory of lists of files to monitor.</para>

-    <para>/usr/share/doc/logcheck-database/README.logcheck-database.gz for hints on how to write, test and maintain rules.</para>

+    <para>%%ETCDIR%%/logcheck.conf is the main configuration file.</para>

+    <para>%%ETCDIR%%/logcheck.logfiles is the list of files to monitor.</para>

+    <para>%%ETCDIR%%/logcheck.logfiles.d is the directory of lists of files to monitor.</para>

+    <para>%%DOCSDIR%%/README.logcheck-database for hints on how to write, test and maintain rules.</para>

   </refsect1>

   <refsect1>

     <title>EXIT STATUS</title>

--- docs/logtail2.8.orig	2017-01-25 21:08:04 UTC

+++ docs/logtail2.8

@@ -38,7 +38,7 @@ is not empty, the inode of

 is checked.  If the inode is changed,

 .B logtail2

 uses the heuristics stored in

-.I /usr/share/logtail/detectrotate/

+.I %%DATADIR%%/detectrotate/

 to find a file that might be the rotated

 .I logfile

 and prints it starting with the stored offset. It then proceeds to

--- etc/logcheck.conf.orig	2017-01-25 21:08:04 UTC

+++ etc/logcheck.conf

@@ -9,7 +9,7 @@

 # Controls the presence of boilerplate at the top of each message:

 # Alternatively, set to "0" to disable the introduction.

 #

-# If the files /etc/logcheck/header.txt and /etc/logcheck/footer.txt

+# If the files %%ETCDIR%%/header.txt and %%ETCDIR%%/footer.txt

 # are present their contents will be read and used as the header and

 # footer of any generated mails.

@@ -44,8 +44,8 @@ FQDN=1

 #SORTUNIQ=0

-# Controls whether /etc/logcheck/cracking.ignore.d is scanned for

-# exceptions to the rules in /etc/logcheck/cracking.d:

+# Controls whether %%ETCDIR%%/cracking.ignore.d is scanned for

+# exceptions to the rules in %%ETCDIR%%/cracking.d:

 # Alternatively, set to "1" to enable cracking.ignore support

 #SUPPORT_CRACKING_IGNORE=0

@@ -53,13 +53,7 @@ FQDN=1

 # Controls the base directory for rules file location

 # This must be an absolute path

-#RULEDIR="/etc/logcheck"

-

-# Controls if syslog-summary is run over each section.

-# Alternatively, set to "1" to enable extra summary.

-# HINT: syslog-summary needs to be installed.

-

-#SYSLOGSUMMARY=0

+#RULEDIR="%%ETCDIR%%"

 # Controls Subject: lines on logcheck reports:

--- etc/logcheck.logfiles.orig	2017-01-25 21:08:04 UTC

+++ etc/logcheck.logfiles

@@ -1,4 +1,4 @@

 # these files will be checked by logcheck

 # This has been tuned towards a default syslog install

-/var/log/syslog

 /var/log/auth.log

+/var/log/messages

--- src/logcheck.orig	2017-07-11 17:32:13 UTC

+++ src/logcheck

@@ -24,17 +24,10 @@

 if [ `id -u` = 0 ]; then

     echo "logcheck should not be run as root. Use su to invoke logcheck:"

-    echo "su -s /bin/bash -c \"/usr/sbin/logcheck${@:+ $@}\" logcheck"

+    echo "su -m %%LOGCHECK_USER%% -c \"%%LOCALBASE%%/bin/bash %%PREFIX%%/sbin/logcheck${@:+ $@}\""

     echo "Or use sudo: sudo -u logcheck logcheck${@:+ $@}."

     # you may want to uncomment that hack to let logcheck invoke itself.

-    # su -s /bin/bash -c "$0 $*" logcheck

-    exit 1

-fi

-

-if [ ! -f /usr/bin/lockfile-create -o \

-     ! -f /usr/bin/lockfile-remove -o \

-     ! -f /usr/bin/lockfile-touch ]; then

-    echo "fatal: lockfile-progs is a prerequisite for logcheck, and was not found."

+    # su -s %%LOCALBASE%%/bin/bash -c "$0 $*" logcheck

     exit 1

 fi

@@ -69,13 +62,13 @@ EVENTSSUBJECT="System Events"

 ADDTAG="no"

 # Set the default paths

-RULEDIR="/etc/logcheck"

-CONFFILE="/etc/logcheck/logcheck.conf"

-STATEDIR="/var/lib/logcheck"

-LOGFILES_LIST="/etc/logcheck/logcheck.logfiles"

-LOGFILES_LIST_D="/etc/logcheck/logcheck.logfiles.d"

-LOGFILE_FALLBACK="/var/log/syslog"

-LOGTAIL="/usr/sbin/logtail2"

+RULEDIR="%%ETCDIR%%"

+CONFFILE="%%ETCDIR%%/logcheck.conf"

+STATEDIR="%%DBDIR%%"

+LOGFILES_LIST="%%ETCDIR%%/logcheck.logfiles"

+LOGFILES_LIST_D="%%ETCDIR%%/logcheck.logfiles.d"

+LOGFILE_FALLBACK="/var/log/messages"

+LOGTAIL="%%PREFIX%%/sbin/logtail2"

 CAT="/bin/cat"

 SYSLOG_SUMMARY="/usr/bin/syslog-summary"

@@ -90,20 +83,15 @@ FQDN=0

 SORTUNIQ=0

 SUPPORT_CRACKING_IGNORE=0

 SYSLOGSUMMARY=0

-LOCKDIR=/run/lock/logcheck

+LOCKDIR=/var/run/logcheck

 LOCKFILE="$LOCKDIR/logcheck"

 # Carry out the clean up tasks

 cleanup() {

-    if [ -n "$LOCK" ]; then

-        debug "cleanup: Killing lockfile-touch - $LOCK"

-	kill "$LOCK" && unset LOCK

-    fi

-

-    if [ -f "$LOCKFILE.lock" ]; then

-        debug "cleanup: Removing lockfile: $LOCKFILE.lock"

-	lockfile-remove "$LOCKFILE"

+    if [ -f "$LOCKFILE" ]; then

+        debug "cleanup: Removing lockfile: $LOCKFILE"

+	rm -f "$LOCKFILE"

     fi

     if [ -d "$TMPDIR" ]; then

@@ -145,14 +133,9 @@ error() {

     if [ "$2" = "noclean" ]; then

 	debug "error: Not removing lockfile"

     else

-        if [ -n "$LOCK" ]; then

-	    debug "error: Killing lockfile-touch - $LOCK"

-	    kill "$LOCK" && unset LOCK

-	fi

-

-       if [ -f "$LOCKFILE.lock" ]; then

-           debug "error: Removing lockfile: $LOCKFILE.lock"

-           lockfile-remove "$LOCKFILE"

+       if [ -f "$LOCKFILE" ]; then

+           debug "error: Removing lockfile: $LOCKFILE"

+           rm -f "$LOCKFILE"

        fi

     fi

@@ -171,7 +154,7 @@ $message

 ${TMPDIR:+Check temporary directory: $TMPDIR

 }

 Also verify that the logcheck user can read all files referenced in

-/etc/logcheck/logcheck.logfiles!

+%%ETCDIR%%/logcheck.logfiles!

 $(export)

 EOF

@@ -223,7 +206,7 @@ cleanrules() {

 			error "Couldn't read $x"

 		fi

 	done

-	for rulefile in $(run-parts --list "$dir"); do

+	for rulefile in $(ls -1R "$dir"); do

 	    rulefile="$(basename "$rulefile")"

 	    if [ -f "${dir}/${rulefile}" ]; then

 		debug "cleanrules: ${dir}/${rulefile}"

@@ -538,9 +521,9 @@ fi

 # Hostname either fully qualified or not.

 if [ "$FQDN" -eq 1 ]; then

-        HOSTNAME="$(hostname --fqdn 2>/dev/null)"

+        HOSTNAME="$(hostname -f 2>/dev/null)"

 else

-        HOSTNAME="$(hostname --short 2>/dev/null)"

+        HOSTNAME="$(hostname -s 2>/dev/null)"

 fi

 # Now check for the other options

@@ -623,30 +606,25 @@ fi

 trap 'cleanup' 0

-debug "Trying to get lockfile: $LOCKFILE.lock"

+debug "Trying to get lockfile: $LOCKFILE"

 if [ ! -d "$LOCKDIR" ]; then

 	mkdir -m 0755 "$LOCKDIR"

 fi

-lockfile-create --retry 1 "$LOCKFILE" > /dev/null 2>&1

+lockfile -r 1 "$LOCKFILE" > /dev/null 2>&1

 if [ $? -eq 1 ]; then

     trap 0

-    if [ -e "${LOCKFILE}.lock" ]; then

+    if [ -e "${LOCKFILE}" ]; then

         error "Another logcheck process is still running" "noclean"

     else

-        error "Failed to get lockfile: $LOCKFILE.lock" "noclean"

+        error "Failed to get lockfile: $LOCKFILE" "noclean"

     fi

-

-else

-    debug "Running lockfile-touch $LOCKFILE.lock"

-    lockfile-touch "$LOCKFILE" &

-    LOCK="$!"

 fi

 # Create the secure temporary directory or exit

-TMPDIR="$(mktemp -d -p "${TMP:-/tmp}" logcheck.XXXXXX)" \

-    || TMPDIR="$(mktemp -d -p /var/tmp logcheck.XXXXXX)" \

+TMPDIR="$(mktemp -d ${TMP:-/tmp}/logcheck.XXXXXX)" \

+    || TMPDIR="$(mktemp -d /var/tmp/logcheck.XXXXXX)" \

     || error "Could not create temporary directory"

 # Now clean the rulefiles in the directories

--- src/logcheck-test.orig	2017-01-25 21:08:04 UTC

+++ src/logcheck-test

@@ -38,7 +38,7 @@ usage() {

 usage: logcheck-test

 -h|--help                   : Show usage information

 -a|--auth.log               : Parse /var/log/auth.log

--s|--syslog                 : Parse /var/log/syslog

+-m|--messages               : Parse /var/log/messages

 -l|--log-file LOGFILE       : Parse LOGFILE

 -i|--invert-match           : Show lines that don't match the RULE or RULEFILE

 -q|--quiet                  : Suppress rule summary

@@ -103,9 +103,9 @@ while [ -n "${1:-}" ]; do

                 warn "option -a ignored"

             fi

         ;;

-        -s|--syslog)

+        -m|--messages)

             if [ -z "$FILE" ] ; then

-                FILE="/var/log/syslog"

+                FILE="/var/log/messages"

             else

                 warn "option -s ignored"

             fi

--- src/logtail2.orig	2017-07-11 17:32:13 UTC

+++ src/logtail2

@@ -109,7 +109,7 @@ sub determine_rotated_logfile {

     # function with dateext magic added.

     #print "determine_rotated_logfile $filename $inode\n";

-    for my $codefile (glob("/usr/share/logtail/detectrotate/*.dtr")) {

+    for my $codefile (glob("%%DATADIR%%/detectrotate/*.dtr")) {

         my $func = do $codefile;

         if (!$func) {

 	    print STDERR "cannot compile $codefile: $!";

%%DATADIR%%/detectrotate/10-savelog.dtr

%%DATADIR%%/detectrotate/20-logrotate.dtr

%%DATADIR%%/detectrotate/30-logrotate-dateext.dtr

%%ETCDIR%%/ignore.d.server/systemd

%%ETCDIR%%/ignore.d.server/systemd-timesyncd

%%ETCDIR%%/logcheck.conf.sample

%%ETCDIR%%/logcheck.logfiles.sample

bin/logcheck-test

man/man1/logcheck-test.1.gz