Logcheck devel - Jan 2016 - Bug#809605: logcheck: dhclient rules do not match because of [pid]

Package: logcheck
Version: 1.3.17
Severity: normal

I'm getting lines like this in logcheck emails:

Jan  1 00:03:21 getz dhclient[27185]: DHCPREQUEST of 82.27.1.1 on enp2s0 to
62.254.1.1 port 67

despite there being lines in ignore.d.server/dhclient that are clearly intended
to match it:

^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhclient(-2.2.x)?: DHCP(REQUEST|RELEASE) (of
[.0-9]{7,15} )?on [[:alnum:].-]+ to [.0-9]{7,15} port 67$

This doesn't match, clearly, since the regex doesn't take account of the
[pid]
following dhclient.

an alternative regex might be:

^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhclient(-2.2.x)?\[[1-9][0-9]*]:
DHCP(REQUEST|RELEASE) (of [.0-9]{7,15} )?on [[:alnum:].-]+ to [.0-9]{7,15} port
67$

which would need to be done for all such lines in the dhclient ignore file.


Unless, for some reason my system is syslogging the pid when it shouldn't
be?


thanks much,
calum.

-- System Information:
Debian Release: stretch/sid
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.3.0-1-amd64 (SMP w/2 CPU cores)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: sysvinit (via /sbin/init)

Versions of packages logcheck depends on:
ii  adduser                                    3.113+nmu3
ii  cron                                       3.0pl1-128
ii  exim4-daemon-heavy [mail-transport-agent]  4.86-7
ii  lockfile-progs                             0.1.17
ii  logtail                                    1.3.17
ii  mime-construct                             1.11+nmu1
ii  rsyslog [system-log-daemon]                8.12.0-1

Versions of packages logcheck recommends:
ii  logcheck-database  1.3.17

Versions of packages logcheck suggests:
ii  syslog-summary  1.14-2.1

-- Configuration Files:
/etc/cron.d/logcheck changed:
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
MAILTO=root
@reboot         logcheck    if [ -x /usr/sbin/logcheck ]; then nice -n10
/usr/sbin/logcheck -R; fi
4 * * * *       logcheck    if [ -x /usr/sbin/logcheck ]; then nice -n10
/usr/sbin/logcheck; fi

/etc/logcheck/logcheck.conf [Errno 13] Permission denied:
u'/etc/logcheck/logcheck.conf'
/etc/logcheck/logcheck.logfiles [Errno 13] Permission denied:
u'/etc/logcheck/logcheck.logfiles'

-- no debconf information

Your message dated Wed, 25 Jan 2017 22:05:37 +0000
with message-id <E1cWVhB-0002wY-1N at fasolo.debian.org>
and subject line Bug#809605: fixed in logcheck 1.3.18
has caused the Debian Bug report #809605,
regarding logcheck: dhclient rules do not match because of [pid]
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner at bugs.debian.org
immediately.)


-- 
809605: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=809605
Debian Bug Tracking System
Contact owner at bugs.debian.org with problems
-------------- next part --------------
An embedded message was scrubbed...
From: Calum Mackay <calum.mackay at cdmnet.org>
Subject: logcheck: dhclient rules do not match because of [pid]
Date: Fri, 01 Jan 2016 18:11:17 +0000
Size: 5144
URL:
<http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20170125/f0404c94/attachment-0002.mht>
-------------- next part --------------
An embedded message was scrubbed...
From: Hannes von Haugwitz <hannes at vonhaugwitz.com>
Subject: Bug#809605: fixed in logcheck 1.3.18
Date: Wed, 25 Jan 2017 22:05:37 +0000
Size: 7772
URL:
<http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20170125/f0404c94/attachment-0003.mht>