Jim Meyering
2004-Nov-04 09:45 UTC
[Logcheck-devel] Bug#279635: logcheck: empty line in `local' file is copied to egrep pattern file
Package: logcheck
Version: 1.2.30
Severity: important
With the installation of logcheck-1.2.30, I started getting hundreds
of lines of messages every hour. The problem was that
I had a blank line in violations.d/local.
Of course, I shouldn't have had a blank line in the file
in the first place.
Here's a patch that fixed it:
--- /usr/sbin/logcheck.~5~ 2004-11-04 10:04:55.000000000 +0100
+++ /usr/sbin/logcheck 2004-11-04 10:30:21.000000000 +0100
@@ -615,7 +615,7 @@
mkdir $TMPDIR/logoutput \
|| error "Could not mkdir for log files"
if [ ! $LOGFILE ]; then
- for file in $(egrep --text -v "(^#|^[[:space:]]\+$)"
$LOGFILES_LIST); do
+ for file in $(egrep --text -v "(^#|^[[:space:]]*$)"
$LOGFILES_LIST); do
logoutput "$file"
done
elif [ $LOGFILE ]; then
-- System Information:
Debian Release: 3.1
APT prefers unstable
APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: i386 (i686)
Kernel: Linux 2.6.9jmm
Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968)
Versions of packages logcheck depends on:
ii adduser 3.59 Add and remove users and groups
ii cron 3.0pl1-86 management of regular background p
ii debconf [debconf 1.4.39 Debian configuration management sy
ii debianutils 2.10.3 Miscellaneous utilities specific t
ii lockfile-progs 0.1.10 Programs for locking and unlocking
ii logcheck-databas 1.2.30 A database of system log rules for
ii logtail 1.2.30 Print log file lines that have not
ii mailx 1:8.1.2-0.20040524cvs-1 A simple mail user agent
ii perl 5.8.4-3 Larry Wall's Practical
Extraction
ii postfix [mail-tr 2.1.5-1 A high-performance mail transport
ii sysklogd [system 1.4.1-15 System Logging Daemon
-- debconf information:
logcheck/security_level: workstation
logcheck/manage_conffiles: true
logcheck/upgrade-note:
* logcheck/noroot:
* logcheck/changes:
* logcheck/install-note:
logcheck/email_address: root
logcheck/rewrite-note:
Todd Troxell
2004-Nov-04 21:39 UTC
Bug#279635: [Logcheck-devel] Bug#279635: logcheck: empty line in `local' file is copied to egrep pattern file
On Thu, Nov 04, 2004 at 10:45:07AM +0100, Jim Meyering wrote:> Package: logcheck > Version: 1.2.30 > Severity: important > > With the installation of logcheck-1.2.30, I started getting hundreds > of lines of messages every hour. The problem was that > I had a blank line in violations.d/local. > Of course, I shouldn't have had a blank line in the file > in the first place. > > Here's a patch that fixed it: > > --- /usr/sbin/logcheck.~5~ 2004-11-04 10:04:55.000000000 +0100 > +++ /usr/sbin/logcheck 2004-11-04 10:30:21.000000000 +0100 > @@ -615,7 +615,7 @@ > mkdir $TMPDIR/logoutput \ > || error "Could not mkdir for log files" > if [ ! $LOGFILE ]; then > - for file in $(egrep --text -v "(^#|^[[:space:]]\+$)" $LOGFILES_LIST); do > + for file in $(egrep --text -v "(^#|^[[:space:]]*$)" $LOGFILES_LIST); do > logoutput "$file" > done > elif [ $LOGFILE ]; thenI am confused. Doesn't line 618 just parse the list of logfiles to be processed? How could this cause a blank line in violations.d/local to be a problem? Did we get a patch applied in the wrong place? -- [ Todd J. Troxell ,''`. Student, Debian GNU/Linux Developer, SysAdmin, Geek : :' : http://debian.org || http://rapidpacket.com/~xtat `. `' `- ] -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 189 bytes Desc: Digital signature Url : http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20041104/6398b7ea/attachment.pgp
Debian Bug Tracking System
2004-Nov-09 09:03 UTC
[Logcheck-devel] Bug#279635: marked as done (logcheck: empty line in `local' file is copied to egrep pattern file)
Your message dated Tue, 09 Nov 2004 03:47:03 -0500 with message-id <E1CRReZ-0006aq-00 at newraff.debian.org> and subject line Bug#279635: fixed in logcheck 1.2.31 has caused the attached Bug report to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what I am talking about this indicates a serious mail system misconfiguration somewhere. Please contact me immediately.) Debian bug tracking system administrator (administrator, Debian Bugs database) -------------------------------------- Received: (at submit) by bugs.debian.org; 4 Nov 2004 09:46:14 +0000>From meyering at pi.meyering.net Thu Nov 04 01:46:14 2004Return-path: <meyering at pi.meyering.net> Received: from mx.meyering.net [82.230.74.64] by spohr.debian.org with esmtp (Exim 3.35 1 (Debian)) id 1CPeC6-0000Jy-00; Thu, 04 Nov 2004 01:46:14 -0800 Received: by mx.meyering.net (Acme Bit-Twister, from userid 1002) id 6547C4013; Thu, 4 Nov 2004 10:45:07 +0100 (CET) To: Debian Bug Tracking System <submit at bugs.debian.org> Subject: logcheck: empty line in `local' file is copied to egrep pattern file From: Jim Meyering <meyering at pi.meyering.net> Date: Thu, 04 Nov 2004 10:45:07 +0100 Message-ID: <85k6t2aqxo.fsf at pi.meyering.net> Lines: 54 MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Delivered-To: submit at bugs.debian.org X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2004_03_25 (1.212-2003-09-23-exp) on spohr.debian.org X-Spam-Status: No, hits=-8.0 required=4.0 tests=BAYES_00,HAS_PACKAGE autolearn=no version=2.60-bugs.debian.org_2004_03_25 X-Spam-Level: Package: logcheck Version: 1.2.30 Severity: important With the installation of logcheck-1.2.30, I started getting hundreds of lines of messages every hour. The problem was that I had a blank line in violations.d/local. Of course, I shouldn't have had a blank line in the file in the first place. Here's a patch that fixed it: --- /usr/sbin/logcheck.~5~ 2004-11-04 10:04:55.000000000 +0100 +++ /usr/sbin/logcheck 2004-11-04 10:30:21.000000000 +0100 @@ -615,7 +615,7 @@ mkdir $TMPDIR/logoutput \ || error "Could not mkdir for log files" if [ ! $LOGFILE ]; then - for file in $(egrep --text -v "(^#|^[[:space:]]\+$)" $LOGFILES_LIST); do + for file in $(egrep --text -v "(^#|^[[:space:]]*$)" $LOGFILES_LIST); do logoutput "$file" done elif [ $LOGFILE ]; then -- System Information: Debian Release: 3.1 APT prefers unstable APT policy: (500, 'unstable'), (1, 'experimental') Architecture: i386 (i686) Kernel: Linux 2.6.9jmm Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968) Versions of packages logcheck depends on: ii adduser 3.59 Add and remove users and groups ii cron 3.0pl1-86 management of regular background p ii debconf [debconf 1.4.39 Debian configuration management sy ii debianutils 2.10.3 Miscellaneous utilities specific t ii lockfile-progs 0.1.10 Programs for locking and unlocking ii logcheck-databas 1.2.30 A database of system log rules for ii logtail 1.2.30 Print log file lines that have not ii mailx 1:8.1.2-0.20040524cvs-1 A simple mail user agent ii perl 5.8.4-3 Larry Wall's Practical Extraction ii postfix [mail-tr 2.1.5-1 A high-performance mail transport ii sysklogd [system 1.4.1-15 System Logging Daemon -- debconf information: logcheck/security_level: workstation logcheck/manage_conffiles: true logcheck/upgrade-note: * logcheck/noroot: * logcheck/changes: * logcheck/install-note: logcheck/email_address: root logcheck/rewrite-note: --------------------------------------- Received: (at 279635-close) by bugs.debian.org; 9 Nov 2004 08:55:04 +0000>From katie at ftp-master.debian.org Tue Nov 09 00:55:03 2004Return-path: <katie at ftp-master.debian.org> Received: from newraff.debian.org [208.185.25.31] (mail) by spohr.debian.org with esmtp (Exim 3.35 1 (Debian)) id 1CRRmJ-0007qS-00; Tue, 09 Nov 2004 00:55:03 -0800 Received: from katie by newraff.debian.org with local (Exim 3.35 1 (Debian)) id 1CRReZ-0006aq-00; Tue, 09 Nov 2004 03:47:03 -0500 From: Todd Troxell <ttroxell at debian.org> To: 279635-close at bugs.debian.org X-Katie: $Revision: 1.51 $ Subject: Bug#279635: fixed in logcheck 1.2.31 Message-Id: <E1CRReZ-0006aq-00 at newraff.debian.org> Sender: Archive Administrator <katie at ftp-master.debian.org> Date: Tue, 09 Nov 2004 03:47:03 -0500 Delivered-To: 279635-close at bugs.debian.org X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2004_03_25 (1.212-2003-09-23-exp) on spohr.debian.org X-Spam-Status: No, hits=-6.0 required=4.0 tests=BAYES_00,HAS_BUG_NUMBER autolearn=no version=2.60-bugs.debian.org_2004_03_25 X-Spam-Level: X-CrossAssassin-Score: 2 Source: logcheck Source-Version: 1.2.31 We believe that the bug you reported is fixed in the latest version of logcheck, which is due to be installed in the Debian FTP archive: logcheck-database_1.2.31_all.deb to pool/main/l/logcheck/logcheck-database_1.2.31_all.deb logcheck_1.2.31.dsc to pool/main/l/logcheck/logcheck_1.2.31.dsc logcheck_1.2.31.tar.gz to pool/main/l/logcheck/logcheck_1.2.31.tar.gz logcheck_1.2.31_all.deb to pool/main/l/logcheck/logcheck_1.2.31_all.deb logtail_1.2.31_all.deb to pool/main/l/logcheck/logtail_1.2.31_all.deb A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 279635 at bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Todd Troxell <ttroxell at debian.org> (supplier of updated logcheck package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster at debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Format: 1.7 Date: Tuesday, 09 Nov 2004 03:25:11 -0500 Source: logcheck Binary: logcheck logtail logcheck-database Architecture: source all Version: 1.2.31 Distribution: unstable Urgency: low Maintainer: Debian logcheck Team <logcheck-devel at lists.alioth.debian.org> Changed-By: Todd Troxell <ttroxell at debian.org> Description: logcheck - Mails anomalies in the system logfiles to the administrator logcheck-database - A database of system log rules for the use of log checkers logtail - Print log file lines that have not been read Closes: 270018 279635 Changes: logcheck (1.2.31) unstable; urgency=low . jamie * Fix rules for hylafax, thanks to Ross Boylan. (closes: #270018) max * Add rule for tripwire run at level paranoid. * Add rule for nscd at level server. alfie: * Fixed my non-fix in logcheck, sorry (closes: #279635) todd: * Fix segmented rules, thanks rloboda at bojko.krakow.pl Files: b753d6aa552144af9f0413ae10daacfd 703 admin optional logcheck_1.2.31.dsc f14efaf0494e4a2ce2840cfd8d7cf205 86528 admin optional logcheck_1.2.31.tar.gz e2fb0d8cecf58b65de828cb42a6dd52f 40604 admin optional logcheck_1.2.31_all.deb 1a502877f44cb18a359d125b5f00c608 53990 admin optional logcheck-database_1.2.31_all.deb d41144f2933fa425069885a824104dfb 24186 admin optional logtail_1.2.31_all.deb -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFBkH9v4u3oQ3FHP2YRAgTGAJ9zpLBfK0WrgvHVUcBO0Xqrw407aACeIu0f ikZMIHxu3cJ1tSZQYBvbMyQ=aWG+ -----END PGP SIGNATURE-----