Logcheck devel - Jan 2011 - Bug#608574: [PATCH] updated rules for dnsmasq

Package: logcheck

I'm running dnsmasq-2.52 on a Gentoo Linux server, and the default rules
for dnsmasq needed a few minor updates.

See attached patch for suggested changes.

Here are the relevant log lines:

Jan  1 12:07:11 hq dnsmasq-dhcp[4093]: DHCPNAK(eth0) 192.168.20.107
00:26:37:a0:75:57 wrong server-ID
Jan  1 12:28:39 hq dnsmasq-dhcp[4093]: DHCPNAK(eth0) 192.168.20.107
00:26:37:a0:75:57 wrong server-ID
Jan  1 12:39:09 hq dnsmasq-dhcp[4093]: DHCPNAK(eth0) 192.168.20.107
00:26:37:a0:75:57 wrong server-ID

Jan  1 15:27:36 hq dnsmasq-dhcp[4093]: Ignoring domain sternik.org.pl
for DHCP host name (null)
Jan  1 15:57:00 hq dnsmasq-dhcp[4093]: Ignoring domain sternik.org.pl
for DHCP host name (null)
Jan  1 17:02:13 hq dnsmasq-dhcp[4093]: Ignoring domain sternik.org.pl
for DHCP host name (null)
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: 0001-More-complete-rules-for-dnsmasq.patch
URL:
<http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20110101/bad97de1/attachment.asc>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 194 bytes
Desc: OpenPGP digital signature
URL:
<http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20110101/bad97de1/attachment.pgp>

On 9/1/11 11:20 PM, Hannes von Haugwitz wrote:
> Please explain why messages like "Ignoring domain" or "wrong
server-ID"
> are messages an administrator doesn't want to see at least once to
react
> accordingly (eg by adding local rules or fix the causing issue). In my
> opinion logcheck should only filter those messages by default which are
> just informational and aren't caused by an error.
Right, I guess _some_ administrators may want to see those messages.

However, in my opinion it's mostly noise. The machine in question was a
part of a Windows domain I think, and when it connected to the DHCP
server running logcheck, it tried to use the Windowsic configuration
which resulted in those messages.

There are already examples of arguably similar messages being ignored by
logcheck, e.g. for cups-lpd:

^\w{3} [ :0-9]{11} [._[:alnum:]-]+ cups-lpd\[[0-9]+\]: Unknown
command-line option "\\" ignored!$

Please let me know if I can provide some more info. Thank you for
careful checking of the filtering rules.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 194 bytes
Desc: OpenPGP digital signature
URL:
<http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20110902/79029be7/attachment.pgp>