Same problem here (running Debian Squeeze), I regularly see lots of messages like: Nov 1 15:49:22 mosquito dnsmasq-dhcp[17144]: DHCPNAK(vlan3) 192.168.1.171 00:1f:1f:02:74:81 wrong server-ID Correct fix for logcheck seems to be this line: ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dnsmasq-dhcp\[[0-9]+\]: DHCPNAK\([.[:alnum:]]+\) [.[:digit:]]{7,15} [:[:xdigit:]]{17} wrong server-ID$ cheers, David -- GnuPG public key: http://dvdkhlng.users.sourceforge.net/dk.gpg Fingerprint: B17A DC95 D293 657B 4205 D016 7DEF 5323 C174 7D40 -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 197 bytes Desc: not available URL: <http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20111101/02a8c627/attachment.pgp>