--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/api_secret.py.dist	Tue Mar 25 19:10:59 2008 +0200
@@ -0,0 +1,5 @@
+# the shared static secret to use for API connections. This file shouldn't be world-readable
+
+# this should be a string
+secret = please replace me
+

--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/logwatch_config.py.dist	Tue Mar 25 19:10:59 2008 +0200
@@ -0,0 +1,13 @@
+from logwatch_filters import *
+
+# log_files is a sequence of three-tuples
+log_files = (
+    # (name, filename, filter-seq))
+    # name is used for display purposes, filename is the file to follow, and filter-seq is a list of filters to apply to each line of output
+    # filters should inherit from logwatch_filters.Filter
+    ("auth.log", "/var/log/auth.log", (
+        SudoFilter(),
+#       SSHFilter(),
+    )),
+)
+

--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/logwatch_filters.py	Tue Mar 25 19:10:59 2008 +0200
@@ -0,0 +1,43 @@
+import re
+
+class Filter (object) :
+    def __init__ (self, regexp, event_type) :
+        self.regexp = re.compile(regexp)
+        self.event_type = event_type
+
+    def test (self, line) :
+        match = self.regexp.search(line)
+        
+        if match :
+            return self._filter(match)
+        
+    def _filter (self, match) :
+        return match.string
+
+class AutoFilter (Filter) :
+    # your event type here, as a string
+    EVENT = None
+
+    # your regexp here, with named matchgroups
+    REGEXP = None
+
+    # your output format, with named interpolation params
+    OUTPUT = None
+    
+    def __init__ (self) :
+        super(AutoFilter, self).__init__(self.REGEXP, self.EVENT)
+    
+    def _filter (self, match) :
+        return self.OUTPUT % match.groupdict()
+
+class SudoFilter (AutoFilter) :
+    EVENT   = "sudo"
+    REGEXP  = "sudo:\s*(?P<username>\S+) : TTY=(?P<tty>\S+) ; PWD=(?P<pwd>.+?) ; USER=(?P<target_user>\S+) ; COMMAND=(?P<command>.*)"
+    OUTPUT  = "%(username)s:%(tty)s - %(pwd)s - `%(command)s` as %(target_user)s"
+
+class SSHFilter (AutoFilter) :
+    EVENT   = "ssh"
+    REGEXP  = "(?P<success>Accepted|Failed) password for (?P<username>\S+) from (?P<ip>\S+) port (?P<port>\S+) (?P<proto>\S+)"
+    OUTPUT  = "%(success)s login for %(username)s from %(ip)s:%(port)s proto %(proto)s"
+
+