Logcheck devel - Oct 2008 - Bug#502965: please consider these rules for openntpd

Package: logcheck-database
Version: 1.2.68~bpo40+2
Severity: wishlist

Hello cute duck,

Could you please consider the following rules to mitigate the very, very, very,
very annoying messages coming from openntpd on certain servers?

^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: reply from [0-9.]+: negative
delay -[0-9]+.[0-9]+$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: reply from [0-9.]+: not
synced, next query [0-9]+s$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: clock is now (un|)synced$

-- System Information:
Debian Release: lenny/sid
  APT prefers unstable
  APT policy: (990, 'unstable'), (1, 'experimental')
Architecture: i386 (i686)

Kernel: Linux 2.6.26-1-686 (SMP w/1 CPU core)
Locale: LANG=ca_ES.UTF-8, LC_CTYPE=ca_ES.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

On Tue, Oct 21, 2008 at 01:16:17PM +0200, Jordi Mallach
wrote:
> Could you please consider the following rules to mitigate the very, very,
very, very annoying messages coming from openntpd on certain servers?
> 
> ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: reply from [0-9.]+:
negative delay -[0-9]+.[0-9]+$
> ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: reply from [0-9.]+: not
synced, next query [0-9]+s$
Don't these indicate that something is seriously wrong?  (See #380737
for an example.)  It seems wrong to me to silence such messages.

(I'm also quite puzzled that you didn't include either "adjusting
local
clock" or "set local clock" messages.  Shouldn't you be
gettting at
least one of those if your openntpd setup is working?)


-- 
Absolutely nothing should be concluded from these figures except that
no conclusion can be drawn from them.
		-- Joseph L. Brothers, Linux/PowerPC Project)