Logcheck devel - Jun 2004 - Bug#186372: logcheck - small regexp updates for dhcp and nfs

hello bastian,

On Wed, 26 Mar 2003, Bastian Blank wrote:
> patch update, forget to support hostnames in dhcp rules.
> 
added your dhcp rules update to logcheck cvs at alioth.
tested them on my machine, patch was fine. :)

> diff -urN logcheck-1.2.12.orig/rulefiles/linux/ignore.d.server/nfs
logcheck-1.2.12/rulefiles/linux/ignore.d.server/nfs
> --- logcheck-1.2.12.orig/rulefiles/linux/ignore.d.server/nfs	1970-01-01
01:00:00.000000000 +0100
> +++ logcheck-1.2.12/rulefiles/linux/ignore.d.server/nfs	2003-03-26
16:56:21.000000000 +0100
> @@ -0,0 +1 @@
> +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ rpc\.mountd: authenticated mount
request from [^[:space:]]+ for
could you update the nfs rule:
*) match the hole line ended with '$'
   (we try to match the complete log line, minus trailing space)
*) if 'from [^[:space:]]+' is a hostname please use [._[:alnum:]-]+,
   it it's an ip use at least [.0-9]{7,15}

thanks for an tested update of the nfs rule, 
looking forward to your response. 
a+ maks

On Sat, Jun 12, 2004 at 12:07:29PM +0200, maks attems
wrote:
> could you update the nfs rule:
> *) match the hole line ended with '$'
>    (we try to match the complete log line, minus trailing space)
> *) if 'from [^[:space:]]+' is a hostname please use
[._[:alnum:]-]+,
>    it it's an ip use at least [.0-9]{7,15}
> thanks for an tested update of the nfs rule, 
> looking forward to your response. 
I attached the updated rule. Also I missed two other dhcp server 3
messages.

Bastian

-- 
Four thousand throats may be cut in one night by a running man.
		-- Klingon Soldier, "Day of the Dove", stardate unknown
-------------- next part --------------
Index: dhcp
==================================================================RCS file:
/cvsroot/logcheck/logcheck/rulefiles/linux/ignore.d.server/dhcp,v
retrieving revision 1.2
diff -u -r1.2 dhcp
--- dhcp	12 Jun 2004 10:12:06 -0000	1.2
+++ dhcp	13 Jun 2004 20:18:15 -0000
@@ -10,6 +10,8 @@
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd(-2.2.x|): DHCPOFFER on [.0-9]+ to
[:[:alnum:]]+ (\([[:alnum:]]+\) |)via [[:alnum:]]+$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd(-2.2.x|): DHCPREQUEST for [.0-9]+
(\([.0-9]+\) |)from [:[:alnum:]]+ (\([[:alnum:]]+\) |)via [[:alnum:]]+$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd(-2.2.x|): DHCPACK on [.0-9]+ to
[:[:alnum:]]+ (\([[:alnum:]]+\) |)via [[:alnum:]]+$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd: DHCPACK to [.0-9]+$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd(-2.2.x|): DHCPINFORM from
[:[:alnum:]]+$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd: DHCPINFORM from [.0-9]+ via
[[:alnum:]]+$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd(-2.2.x|): DHCPNAK on [:[:alnum:]]+$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd(-2.2.x|): DHCPRELEASE on [.0-9]+$
Index: nfs
==================================================================RCS file: nfs
diff -N nfs
--- /dev/null	1 Jan 1970 00:00:00 -0000
+++ nfs	13 Jun 2004 20:18:15 -0000
@@ -0,0 +1 @@
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ rpc\.mountd: authenticated (un|)mount
request from [._[:alnum:]-]+:[0-9]+ for (/[[:alnum:]]*)+ \((/[[:alnum:]]*)+\)$
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 197 bytes
Desc: Digital signature
Url :
http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20040613/b0d2eb12/attachment.pgp

tag #186372 pending
thanks


On Sun, 13 Jun 2004, Bastian Blank wrote:
> I attached the updated rule. Also I missed two other dhcp server 3
> messages.
nice diffing against current cvs!!
i added the nfs rule unchanged, 
and the dhcp rules in consistent way to the others already existent.

thanks for the quick feedback.
a+ maks

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
Url :
http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20040614/70452f84/attachment.pgp

Processing commands for control at bugs.debian.org:
> tag #186372 pending
Bug#186372: logcheck - small regexp updates for dhcp and nfs
There were no tags set.
Tags added: pending
> thanks
Stopping processing here.

Please contact me if you need assistance.

Debian bug tracking system administrator
(administrator, Debian Bugs database)

On Mon, Jun 14, 2004 at 12:36:50PM +0200, maks attems
wrote:
> and the dhcp rules in consistent way to the others already existent.
The 2.2.x suffix is only used by dhcp2 which does not generate this
messages.

Bastian

-- 
Many Myths are based on truth
		-- Spock, "The Way to Eden",  stardate 5832.3
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 197 bytes
Desc: Digital signature
Url :
http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20040614/cb0d809c/attachment.pgp

On Mon, 14 Jun 2004, Bastian Blank wrote:
> On Mon, Jun 14, 2004 at 12:36:50PM +0200, maks attems wrote:
> > and the dhcp rules in consistent way to the others already existent.
> 
> The 2.2.x suffix is only used by dhcp2 which does not generate this
> messages.
thanks for the explanation!
updated cvs, left the extention for the "resolved" hardware address. 

a+ maks

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
Url :
http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20040614/1311ddec/attachment.pgp

Another update

Bastian

-- 
Those who hate and fight must stop themselves -- otherwise it is not stopped.
		-- Spock, "Day of the Dove", stardate unknown
-------------- next part --------------
? test
Index: dhcp
==================================================================RCS file:
/cvsroot/logcheck/logcheck/rulefiles/linux/ignore.d.server/dhcp,v
retrieving revision 1.4
diff -u -r1.4 dhcp
--- dhcp	14 Jun 2004 11:39:24 -0000	1.4
+++ dhcp	28 Jun 2004 19:14:48 -0000
@@ -15,3 +15,4 @@
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd: DHCPACK to [.0-9]+$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd(-2.2.x|): DHCPNAK on [:[:alnum:]]+$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd(-2.2.x|): DHCPRELEASE on [.0-9]+$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd: DHCPRELEASE of [.0-9]+ from
[:[:alnum:]]+ (\([[:alnum:]]+\) |)via [[:alnum:]]+ \((not |)found\)$
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 197 bytes
Desc: Digital signature
Url :
http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20040628/409241d7/attachment.pgp