Logcheck devel - Oct 2004 - Bug#277696: logcheck-database: spelling error in /etc/logcheck/ignore.d.server/uw-imap

Package: logcheck-database
Version: 1.2.28
Severity: minor


I found a spelling error in /etc/logcheck/ignore.d.server/uw-imap. There
is a line that reads:

^\w{3} [ :0-9]{11} [._[:alnum:]-]+ imapd\[[0-9]+\]: (connect|(port
(143|220)|imap(s SSL)?) service init) from [\.0-9]+$

connections from clients read like this on my computer though:

Oct 21 21:45:03 phoenix snmpd[16630]: Connection from 127.0.0.1

So maybe the line should read:

^\w{3} [ :0-9]{11} [._[:alnum:]-]+ imapd\[[0-9]+\]: (connect|Connection|(port
(143|220)|imap(s SSL)?) service init) from [\.0-9]+$


-- System Information:
Debian Release: 3.1
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: i386 (i686)
Kernel: Linux 2.6.8.1
Locale: LANG=nl_NL.ISO-8859-1, LC_CTYPE=nl_NL.ISO-8859-1

Versions of packages logcheck-database depends on:
ii  debconf [debconf-2.0]         1.4.30.8   Debian configuration management sy

-- debconf information:
* logcheck-database/rules-directories-note:
  logcheck-database/standard-rename-note:
  logcheck-database/conffile-cleanup: false

tags 277696 moreinfo
tags 277696 pending
thanks

On Thu, 21 Oct 2004, Wouter de Vries wrote:
> I found a spelling error in /etc/logcheck/ignore.d.server/uw-imap. There
> is a line that reads:
logcheck has no such file, verified with:
dpkg -L logcheck-database | egrep imap
you probably mean /etc/logcheck/ignore.d.paranoid/imap

 
> ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ imapd\[[0-9]+\]: (connect|(port
(143|220)|imap(s SSL)?) service init) from [\.0-9]+$
in aboves file i find this rule:
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ imapd\[[0-9]+\]: port 143 service init
from [^[:space:]]+$
> connections from clients read like this on my computer though:
> 
> Oct 21 21:45:03 phoenix snmpd[16630]: Connection from 127.0.0.1
that logmessages makes no sense.
 
> So maybe the line should read:
> 
> ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ imapd\[[0-9]+\]:
(connect|Connection|(port (143|220)|imap(s SSL)?) service init) from [\.0-9]+$
when improving logcheck rules please place them for your own help
in local-<package> file as described in
-> /usr/share/doc/logcheck-database/README.logcheck-database.gz

please also pay attention to which bug report your answering. ;)

On Thu, 21 Oct 2004, Wouter Leonard de Vries wrote:
> I'm very sorry, I messed up. The lines in my syslog read like this:
> 
> Oct 21 21:36:33 phoenix imapd[1582]: connect from 192.168.1.3
> (192.168.1.3)
that logline makes sense yes.
 
> I'm not sure wether the first one is a hostname or the second, but the 
> line should probably change to:
> 
> ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ imapd\[[0-9]+\]: (connect|(port 
> (143|220)|imap(s SSL)?) service init) from [\.0-9]+ (\([\.0-9]+\))?$
not so bad, but please use at least that '[0-9.]{7,15}' to match an ip.
so i propose the attached rule.

--
maks

here comes the attachment.

-------------- next part --------------
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ imapd\[[0-9]+\]: (connect|(port
(143|220)|imap(s SSL)?) service init) from [0-9.]{7,15}( \([0-9.]{7,15}\))?$

Processing commands for control at bugs.debian.org:
> tags 277696 moreinfo
Bug#277696: logcheck-database: spelling error in
/etc/logcheck/ignore.d.server/uw-imap
There were no tags set.
Tags added: moreinfo
> tags 277696 pending
Bug#277696: logcheck-database: spelling error in
/etc/logcheck/ignore.d.server/uw-imap
Tags were: moreinfo
Tags added: pending
> thanks
Stopping processing here.

Please contact me if you need assistance.

Debian bug tracking system administrator
(administrator, Debian Bugs database)

maks attems wrote:
>tags 277696 moreinfo
>tags 277696 pending
>thanks
>
>On Thu, 21 Oct 2004, Wouter de Vries wrote:
>
>  
>
>>I found a spelling error in /etc/logcheck/ignore.d.server/uw-imap. There
>>is a line that reads:
>>    
>>
>
>logcheck has no such file, verified with:
>dpkg -L logcheck-database | egrep imap
>you probably mean /etc/logcheck/ignore.d.paranoid/imap
>
> 
>
I found out that it is included in the uw-imapd package. Maybe that is 
not a good idea and you should talk to the maintainer of the package.

-- 
Wouter de Vries <w.l.devries at student.tudelft.nl>

severity 277696 wishlist
tags 277696 -pending
tags 277696 -moreinfo
reassign 277696 uw-imapd 
thanks

On Tue, 26 Oct 2004, Wouter Leonard de Vries wrote:
> I found out that it is included in the uw-imapd package. Maybe that is 
> not a good idea and you should talk to the maintainer of the package.
ok great reverted the change in logcheck cvs.

maintainers are highly encouraged to add their logcheck rules,
as they may better know of the severity of the log messages.
thanks for your info, hope that bug get worked on. ;-)


--
maks