Karl Chen
2005-Oct-31 07:45 UTC
[Logcheck-devel] Bug#336558: logcheck: spamd rules in 1.2.42
Package: logcheck
Version: 1.2.42
Severity: normal
Tags: patch
Hi, the new rules in logcheck 1.2.42 for spamd don't work
for me. This patch fixes it:
Index: ignore.d.server/spamd
==================================================================---
ignore.d.server/spamd (revision 1077)
+++ ignore.d.server/spamd (working copy)
@@ -1,6 +1,8 @@
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ spamd\[[0-9]+\]: (spamd: )?connection from
[._[:alnum:]-]+ \[[\.[:digit:]]+\] at port [0-9]+$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ spamd\[[0-9]+\]: (spamd: )?info: setuid to
[[:alnum:]-]+ succeeded$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ spamd\[[0-9]+\]: (spamd: )?(info: )?setuid
to [[:alnum:]-]+ succeeded$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ spamd\[[0-9]+\]: (spamd:
)?(checking|processing) message [^[:space:]]+ for [._[:alnum:]-]+:[0-9]+(\.)?$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ spamd\[[0-9]+\]: (spamd: )?clean message
\([0-9.-]+/[0-9.]+\) for [._[:alnum:]-]+:[0-9]+ in [0-9.]+ seconds, [0-9]+
bytes\.$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ spamd\[[0-9]+\]: (spamd: )?identified spam
\([0-9.-]+/[0-9.]+\) for [._[:alnum:]-]+:[0-9]+ in [0-9.]+ seconds, [0-9]+
bytes\.$
-Oct 21 13:06:02 localhost spamd[5468]: spamd: processing message (unknown) for
siaco:1000
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ spamd\[[0-9]+\]: (spamd: )?result: .*$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ spamd\[[0-9]+\]: (spamd: )?prefork: child
states:.*$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ spamd\[[0-9]+\]: (spamd: )?no response$
Index: violations.ignore.d/logcheck-spamd
==================================================================---
violations.ignore.d/logcheck-spamd (revision 1076)
+++ violations.ignore.d/logcheck-spamd (working copy)
@@ -1,3 +1,4 @@
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ spamd\[[0-9]+\]: Cannot open bayes databases
/home/[_[:alnum:]-]+/.spamassassin/bayes_\* R/W: lock failed: File exists$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ spamd\[[0-9]+\]: failed sanity check, [0-9]+
bytes claimed, [0-9-]+ bytes seen$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ spamd\[[0-9]+\]: processing message
<.+> for .+:[0-9]+\.$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ spamd\[[0-9]+\]: (spamd: )?result: .*$
-- System Information:
Debian Release: testing/unstable
APT prefers testing
APT policy: (500, 'testing'), (500, 'stable'), (60,
'unstable'), (40, 'experimental')
Architecture: i386 (i686)
Shell: /bin/sh linked to /bin/bash
Kernel: Linux 2.6.12-quack+roar.cs.berkeley.edu
Locale: LANG=en_US, LC_CTYPE=en_US (charmap=ISO-8859-1)
Versions of packages logcheck depends on:
ii adduser 3.67.2 Add and remove users and groups
ii cron 3.0pl1-91 management of regular background p
ii debconf [debconf 1.4.58 Debian configuration management sy
ii debianutils 2.15 Miscellaneous utilities specific t
ii grep 2.5.1.ds2-1 GNU grep, egrep and fgrep
ii lockfile-progs 0.1.10 Programs for locking and unlocking
ii logcheck-databas 1.2.42 database of system log rules for t
ii logtail 1.2.42 Print log file lines that have not
ii mailx 1:8.1.2-0.20050715cvs-1 A simple mail user agent
ii postfix [mail-tr 2.2.4-1.0.1 A high-performance mail transport
ii sysklogd [system 1.4.1-17 System Logging Daemon
logcheck recommends no packages.
-- debconf information excluded
Jamie L. Penman-Smithson
2005-Oct-31 17:51 UTC
Bug#336558: [Logcheck-devel] Bug#336558: logcheck: spamd rules in 1.2.42
On Sun, 2005-10-30 at 23:45 -0800, Karl Chen wrote:> Hi, the new rules in logcheck 1.2.42 for spamd don't work > for me. This patch fixes it:<snip> Thanks for the patch.> --- violations.ignore.d/logcheck-spamd (revision 1076) > +++ violations.ignore.d/logcheck-spamd (working copy) > @@ -1,3 +1,4 @@ > ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ spamd\[[0-9]+\]: Cannot open bayes databases /home/[_[:alnum:]-]+/.spamassassin/bayes_\* R/W: lock failed: File exists$ > ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ spamd\[[0-9]+\]: failed sanity check, [0-9]+ bytes claimed, [0-9-]+ bytes seen$ > ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ spamd\[[0-9]+\]: processing message <.+> for .+:[0-9]+\.$ > +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ spamd\[[0-9]+\]: (spamd: )?result: .*$This is far too broad. Please could you provide the log messages you're trying to ignore with this rule. Thanks, -- -Jamie L. Penman-Smithson <jamie at silverdream.org> t: +44 1273 424795; f: +44 1273 424795 PGP: C0A7 955E EED6 A309 23D7 863B C76A 26A3 F0DC FCA8 never send mail to: oubliette.z at gmail.com -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 189 bytes Desc: This is a digitally signed message part Url : http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20051031/af9b3a65/attachment.pgp