Logcheck devel - Jun 2013 - Bug#712941: logcheck-database: logcheck triggers a fatal error in egrep

Package: logcheck-database
  Version: 1.3.15
  Severity: important

Dear Maintainer,
  Since I upgraded to wheezy in may, logcheck reports contain only one
  line:

egrep: character class syntax is [[:space:]], not [:space:]

This is a fatal error.

Downgrading to grep/oldstable 'fixed' this temporarily and restored
  logcheck
  functionality.

The tendency seems to fix each affected package.  I've found several
  that
  were at one point or another affected by this:


https://encrypted.google.com/search?q=%22character+class+syntax+is+[[%3Aspace%3A]]%2C+not+[%3Aspace%3A]%22+&oe=utf-8&rls=org.mozill

Reproductible: always.

System Information:
  Debian Release: 7.0
  APT prefers stable-updates
  APT policy: (990, 'stable-updates'), (990, 'stable'), (100,
  'oldstable')
  Architecture: amd64 (x86_64)
  Foreign Architectures: i386

Kernel: Linux 3.2.0-4-amd64 (SMP w/2 CPU cores)
  Locale: LANG=fr_CA.UTF-8, LC_CTYPE=fr_CA.UTF-8 (charmap=UTF-8)
  Shell: /bin/sh linked to /bin/bash

Configuration Files:
  /etc/logcheck/ignore.d.server/samba changed [not included]

no debconf information

tags 712941 unreproducible moreinfo
thanks

Hello,

On Thu, Jun 20, 2013 at 07:33:51PM -0400, shizuma@vif.com
wrote:
>  Since I upgraded to wheezy in may, logcheck reports contain only one
>  line:
> 
> egrep: character class syntax is [[:space:]], not [:space:]
> 
I''m not able to reproduce this issue on Debian wheezy with the standard
rule set from logcheck-database package.

Please provide more information about how to reproduce this issue.
> Configuration Files:
>  /etc/logcheck/ignore.d.server/samba changed [not included]
Maybe this change or the rule file from another package is causing this
issue. Can you please check that and report back if the issue still
exist?

Best regards

Hannes

tags 712941 unreproducible moreinfo
thanks

Hello,

On Thu, Jun 20, 2013 at 07:33:51PM -0400, shizuma at vif.com
wrote:
>  Since I upgraded to wheezy in may, logcheck reports contain only one
>  line:
> 
> egrep: character class syntax is [[:space:]], not [:space:]
> 
I'm not able to reproduce this issue on Debian wheezy with the standard
rule set from logcheck-database package.

Please provide more information about how to reproduce this issue.
> Configuration Files:
>  /etc/logcheck/ignore.d.server/samba changed [not included]
Maybe this change or the rule file from another package is causing this
issue. Can you please check that and report back if the issue still
exist?

Best regards

Hannes

Processing commands for control at bugs.debian.org:
> tags 712941 unreproducible moreinfo
Bug #712941 [logcheck-database] logcheck-database: logcheck triggers a fatal
error in egrep
Added tag(s) unreproducible and moreinfo.
> thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
712941: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=712941
Debian Bug Tracking System
Contact owner at bugs.debian.org with problems

Hello Hannes,

 Thanks for your assistance.

 I''ve returned my system to pristine wheezy condition (I think):
 tar zcvf my_setup.tgz cracking.* ignore.d.* violations.*
 rm -rf cracking.* ignore.d.* violations.*
 apt-get install --reinstall logcheck-database
 dpkg -i /var/cache/apt/archives/grep_2.12-2_amd64.deb
 mkdir cracking.ignore.d
 chown root.logcheck cracking.ignore.d

 cat logcheck.logfiles
 # these files will be checked by logcheck
 # This has been tuned towards a default syslog install
 /var/log/syslog
 /var/log/auth.log
 logcheck.logfiles (END)

 cat logcheck.conf
 INTRO=0
 REPORTLEVEL="server"
 SENDMAILTO="----@-------"
 MAILASATTACH=0
 FQDN=0
 ATTACKSUBJECT="Security Alerts on -------"
 SECURITYSUBJECT="Security Events on -------"
 EVENTSSUBJECT="System Events on -------"
 TMP="/tmp"
 logcheck.conf (END)

 Is there something else I must do?

 Will keep you posted.

 Thanks.


 On Mon, 1 Jul 2013 06:58:49 +0200, Hannes von Haugwitz
wrote:
> tags 712941 unreproducible moreinfo
> thanks
>
> Hello,
>
> On Thu, Jun 20, 2013 at 07:33:51PM -0400, shizuma@vif.com wrote:
>>  Since I upgraded to wheezy in may, logcheck reports contain only 
>> one
>>  line:
>>
>> egrep: character class syntax is [[:space:]], not [:space:]
>>
>
> I''m not able to reproduce this issue on Debian wheezy with the 
> standard
> rule set from logcheck-database package.
>
> Please provide more information about how to reproduce this issue.
>
>> Configuration Files:
>>  /etc/logcheck/ignore.d.server/samba changed [not included]
>
> Maybe this change or the rule file from another package is causing 
> this
> issue. Can you please check that and report back if the issue still
> exist?
>
> Best regards
>
> Hannes

Hello Hannes,

 Thanks for your assistance.

 I've returned my system to pristine wheezy condition (I think):
 tar zcvf my_setup.tgz cracking.* ignore.d.* violations.*
 rm -rf cracking.* ignore.d.* violations.*
 apt-get install --reinstall logcheck-database
 dpkg -i /var/cache/apt/archives/grep_2.12-2_amd64.deb
 mkdir cracking.ignore.d
 chown root.logcheck cracking.ignore.d

 cat logcheck.logfiles
 # these files will be checked by logcheck
 # This has been tuned towards a default syslog install
 /var/log/syslog
 /var/log/auth.log
 logcheck.logfiles (END)

 cat logcheck.conf
 INTRO=0
 REPORTLEVEL="server"
 SENDMAILTO="---- at -------"
 MAILASATTACH=0
 FQDN=0
 ATTACKSUBJECT="Security Alerts on -------"
 SECURITYSUBJECT="Security Events on -------"
 EVENTSSUBJECT="System Events on -------"
 TMP="/tmp"
 logcheck.conf (END)

 Is there something else I must do?

 Will keep you posted.

 Thanks.


 On Mon, 1 Jul 2013 06:58:49 +0200, Hannes von Haugwitz
wrote:
> tags 712941 unreproducible moreinfo
> thanks
>
> Hello,
>
> On Thu, Jun 20, 2013 at 07:33:51PM -0400, shizuma at vif.com wrote:
>>  Since I upgraded to wheezy in may, logcheck reports contain only 
>> one
>>  line:
>>
>> egrep: character class syntax is [[:space:]], not [:space:]
>>
>
> I'm not able to reproduce this issue on Debian wheezy with the 
> standard
> rule set from logcheck-database package.
>
> Please provide more information about how to reproduce this issue.
>
>> Configuration Files:
>>  /etc/logcheck/ignore.d.server/samba changed [not included]
>
> Maybe this change or the rule file from another package is causing 
> this
> issue. Can you please check that and report back if the issue still
> exist?
>
> Best regards
>
> Hannes