Joshua Powers
2017-Aug-17 17:12 UTC
[Logcheck-devel] Bug#872463: dhclient regex misses 7 length dhclient xid
Package: logcheck
Version: 1.3.18
The regex for dhclient assumes the xid on a dhclient request will always
be 8 in length. However, if there is a leading 0 this is dropped and the
length is then 7. Technically, this could be even 6 or less if there
were additional leading zeros. Here is an example message not caught:
Aug 17 16:43:47 xenial dhclient[5664]: DHCPREQUEST of 192.168.122.59 on
ens3 to 255.255.255.255 port 67 (xid=0x7e8da8e)
This the regex that needs updating:
+^[[:alpha:]]{3} [ :[:digit:]]{11} [._[:alnum:]-]+
dhclient\[[[:digit:]]+\]: DHCP(REQUEST|RELEASE) (of [.0-9]{7,15} )?on
[[:alnum:].-]+ to [.0-9]{7,15} port 67( \(xid=0x[0-9a-f]{8}\))?$
Either get rid of the {8} or expand it to include more lengths.
--
Joshua Powers
Ubuntu Server
Canonical Ltd