#35 Unmatched Entries for ntpd

[Florencia]

Unmatched Entries for ntpd

Description of problem:
Logwatch shows "Unmatched Entries" during normal ntpd startup in Red Hat Enterprise Linux (RHEL) 6.

Version-Release number of selected component (if applicable):
logwatch-7.3.6-52.el6.noarch

How reproducible:
Always

Steps to Reproduce:
1) Edit logwatch.conf:

[root@localhost ~]# cat /etc/logwatch/conf/logwatch.conf 
MailTo = root 
mailer=/usr/sbin/sendmail -t
Range = today
Service = ""
Service = xntpd

2) Restart ntpd:

[root@localhost ~]# service ntpd restart
Shutting down ntpd:                                        [  OK  ]
Starting ntpd:                                             [  OK  ]

3) Check logwatch report:

[root@localhost ~]# logwatch --print

 ################### Logwatch 7.3.6 (05/19/07) #################### 
        Processing Initiated: Mon May 26 11:10:05 2014
        Date Range Processed: today
                              ( 2014-May-26 )
                              Period is day.
      Detail Level of Output: 0
              Type of Output: unformatted
           Logfiles for Host: localhost.localdomain
  ################################################################## 

 --------------------- XNTPD Begin ------------------------ 

 XNTPD Killed: 1 Time(s)

 XNTPD Started: 1 Time(s)

 **Unmatched Entries**
   Listen normally on 4 wlan0 10.97.5.127 UDP 123: 1 time(s)
   Listen normally on 9 vnet1 fe80::fc54:ff:feb0:f26d UDP 123: 1 time(s)
   Listen normally on 5 virbr0 192.168.122.1 UDP 123: 1 time(s)
   Listen normally on 2 lo 127.0.0.1 UDP 123: 1 time(s)
   0.0.0.0 c012 02 freq_set kernel 1.242 PPM: 1 time(s)
   Listen normally on 8 wlan0 fe80::120b:a9ff:fe69:7744 UDP 123: 1 time(s)
   0.0.0.0 c01d 0d kern kernel time sync enabled: 1 time(s)
   Listen normally on 6 vnet0 fe80::fc54:ff:fec0:4b44 UDP 123: 1 time(s)
   Listen normally on 7 lo ::1 UDP 123: 1 time(s)
   Listen and drop on 1 v6wildcard :: UDP 123: 1 time(s)
   peers refreshed: 1 time(s)
   Listen normally on 3 wlan0 192.168.1.35 UDP 123: 1 time(s)
   0.0.0.0 c016 06 restart: 1 time(s)
   Listening on routing socket on fd #26 for interface updates: 1 time(s)
   Listen and drop on 0 v4wildcard 0.0.0.0 UDP 123: 1 time(s)

 ---------------------- XNTPD End ------------------------- 


 ###################### Logwatch End ######################### 

Actual results:

**Unmatched Entries**
   Listen normally on 4 wlan0 10.97.5.127 UDP 123: 1 time(s)
   Listen normally on 9 vnet1 fe80::fc54:ff:feb0:f26d UDP 123: 1 time(s)
   Listen normally on 5 virbr0 192.168.122.1 UDP 123: 1 time(s)
   Listen normally on 2 lo 127.0.0.1 UDP 123: 1 time(s)
   0.0.0.0 c012 02 freq_set kernel 1.242 PPM: 1 time(s)
   Listen normally on 8 wlan0 fe80::120b:a9ff:fe69:7744 UDP 123: 1 time(s)
   0.0.0.0 c01d 0d kern kernel time sync enabled: 1 time(s)
   Listen normally on 6 vnet0 fe80::fc54:ff:fec0:4b44 UDP 123: 1 time(s)
   Listen normally on 7 lo ::1 UDP 123: 1 time(s)
   Listen and drop on 1 v6wildcard :: UDP 123: 1 time(s)
   peers refreshed: 1 time(s)
   Listen normally on 3 wlan0 192.168.1.35 UDP 123: 1 time(s)
   0.0.0.0 c016 06 restart: 1 time(s)
   Listening on routing socket on fd #26 for interface updates: 1 time(s)
   Listen and drop on 0 v4wildcard 0.0.0.0 UDP 123: 1 time(s)

Expected results:
There shouldn't be "Unmatched Entries".

Additional info:

• The script that controls the information about NTP in logwatch is /usr/share/logwatch/scripts/services/xntpd.
  It is necessary to add new lines to match RHEL6 new ntpd startup messages, for example:

[...]
    102     chomp($ThisLine);
    103     if (
    104         ($ThisLine =~ m/tickadj = /) or # startup
    105         ($ThisLine =~ m/precision = /) or # startup
    106         ($ThisLine =~ m/ (succeeded|failed)/) or # startup
    107         ($ThisLine =~ m/kernel time (discipline|sync) status/) or # startup
    108         ($ThisLine =~ m/kernel time sync (dis|en)abled /) or # startup
    109         ($ThisLine =~ m/frequency initialized/) or # startup
    110         ($ThisLine =~ m/using kernel phase-lock loop/) or # startup
    111         ($ThisLine =~ m/select([^\)]) error: Interrupted system call/) or
    112         ($ThisLine =~ m/signal_no_reset: signal \d+ had flags \d+/) or
    113         ($ThisLine =~ /Deleting interface \#[0-9] [^,]*, [^,]*, interface stats: received=.*, sent=.*, dropped=.*, active_time=.* secs/) or
    114         ($ThisLine =~ /Invalid argument/) or
    115         ($ThisLine =~ /Listening on interface .* Disabled/) or
    116         ($ThisLine =~ /Listening on interface .* Enabled/) or
    117 ## START
    118         ($ThisLine =~ /Listen normally on .* /) or
    119         ($ThisLine =~ /Listening on routing socket on .* /) or
    120         ($ThisLine =~ /Listen and drop on .* /) or
    121         ($ThisLine =~ /peers refreshed/) or
    122         ($ThisLine =~ /0.0.0.0 .* /)
    123 ## END
    124     ) {
    125        # Ignore these
[...]

Then run the report to verify:

[root@localhost ~]# logwatch --print

 ################### Logwatch 7.3.6 (05/19/07) #################### 
        Processing Initiated: Mon May 26 14:16:46 2014
        Date Range Processed: today
                              ( 2014-May-26 )
                              Period is day.
      Detail Level of Output: 0
              Type of Output: unformatted
           Logfiles for Host: localhost.localdomain
  ################################################################## 

 --------------------- XNTPD Begin ------------------------ 

 XNTPD Killed: 3 Time(s)

 XNTPD Started: 3 Time(s)

 ---------------------- XNTPD End ------------------------- 


 ###################### Logwatch End ######################### 

[Florencia]

Correction:

Version-Release number of selected component:
logwatch-7.4.0-1

[Stefan Jakobs]

This has already been fixed.