Logcheck devel - Oct 2007 - Bug#448510: logcheck-database: revised pattern for spamd

Package: logcheck-database
Version: 1.2.63
Severity: normal
Tags: patch

spamassassin is now reporting Unix domain sockets in the rport field.
I'm not exactly sure what changed to cause this to happen; it started
after an upgrade whose only remotely relevant package was razor.

I think the following pattern in ignore.d.server/spamd will work
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ (spamd|check|re(port|voke))\[[0-9]+\]:
(spamd: )?result: [.YN] [ [:digit:]-]+ - ([._[:alnum:],]+
)?scantime=[0-9.]+,size=[0-9]+,(user=[^,]+,uid=[0-9]+,required_score=[0-9.]+,rhost=[._[:alnum:]-]+,raddr=[0-9.]+,rport=[^,]+,)?mid=(<[^[:space:]]+>|\(unknown\))(rmid=(<[^[:space:]]+>|\(unknown\)),)?,(bayes=[.[:digit:]]+(e-[[:digit:]]+)?,)?autolearn=(ham|spam|no|disabled|unavailable)
*$

This replaces the previous
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ (spamd|check|re(port|voke))\[[0-9]+\]:
(spamd: )?result: [.YN] [ [:digit:]-]+ - ([._[:alnum:],]+
)?scantime=[0-9.]+,size=[0-9]+,(user=[^,]+,uid=[0-9]+,required_score=[0-9.]+,rhost=[._[:alnum:]-]+,raddr=[0-9.]+,rport=[0-9]+,)?mid=(<[^[:space:]]+>|\(unknown\))(rmid=(<[^[:space:]]+>|\(unknown\)),)?,(bayes=[.[:digit:]]+(e-[[:digit:]]+)?,)?autolearn=(ham|spam|no|disabled|unavailable)
*$

and differs only in the pattern for rport, with [0-9]+ becoming [^,]+.

Without this patch, every message checked for spam results in a report
via logcheck.
-- System Information:
Debian Release: lenny/sid
  APT prefers testing
  APT policy: (990, 'testing'), (990, 'stable'), (50,
'unstable')
Architecture: i386 (i686)

Kernel: Linux 2.6.18-5-686 (SMP w/2 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash

-- debconf information:
  logcheck-database/rules-directories-note:
  logcheck-database/standard-rename-note:
  logcheck-database/conffile-cleanup: false

Your message dated Tue, 03 Jun 2008 22:47:04 +0000
with message-id <E1K3fHU-0000MT-IB at ries.debian.org>
and subject line Bug#448510: fixed in logcheck 1.2.64
has caused the Debian Bug report #448510,
regarding logcheck-database: revised pattern for spamd
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner at bugs.debian.org
immediately.)


-- 
448510: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=448510
Debian Bug Tracking System
Contact owner at bugs.debian.org with problems
-------------- next part --------------
An embedded message was scrubbed...
From: Ross Boylan <RossBoylan at stanfordalumni.org>
Subject: logcheck-database: revised pattern for spamd
Date: Mon, 29 Oct 2007 09:57:38 -0700
Size: 3681
Url:
http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20080603/90aa77c0/attachment.eml
-------------- next part --------------
An embedded message was scrubbed...
From: maximilian attems <maks at debian.org>
Subject: Bug#448510: fixed in logcheck 1.2.64
Date: Tue, 03 Jun 2008 22:47:04 +0000
Size: 9508
Url:
http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20080603/90aa77c0/attachment-0001.eml