Logcheck devel - Feb 2005 - Bug#295560: logcheck: Please include filename when reporting "invalid regular expression"

Package: logcheck
Version: 1.2.34
Severity: wishlist

I have a couple of home-made logcheck ignore files, and happened to
have one unescaped (and unmatched) `(' in one of the filter
lines. Because of this, cron sent a mail with the body "grep: Invalid
regular expression" - the subject is the command in the "2 * * *
*"
line in /etc/cron.d/logcheck, of course.

It would be nice if logcheck would tell me in which file the error
was. This should be easy, since egrep returns 1 if it finds no match
and 2 with an invalid regular expression.

Regards, Frank



-- System Information:
Debian Release: 3.1
  APT prefers testing
  APT policy: (900, 'testing')
Architecture: i386 (i686)
Kernel: Linux 2.4.27
Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968)

Versions of packages logcheck depends on:
ii  adduser                       3.59       Add and remove users and groups
ii  cron                          3.0pl1-86  management of regular background p
ii  debconf [debconf-2.0]         1.4.30.11  Debian configuration management sy
ii  debianutils                   2.8.4      Miscellaneous utilities specific t
ii  exim [mail-transport-agent]   3.36-13    An MTA (Mail Transport Agent)
ii  lockfile-progs                0.1.10     Programs for locking and unlocking
ii  logcheck-database             1.2.34     A database of system log rules for
ii  logtail                       1.2.34     Print log file lines that have not
ii  mailutils [mailx]             1:0.6-2    GNU mailutils utilities for handli
ii  sysklogd [system-log-daemon]  1.4.1-16   System Logging Daemon

-- debconf information:
* logcheck/auto_create_logfiles: true
  logcheck/upgrade-note:
* logcheck/changes:
* logcheck/install-note:
* logcheck/email_address: root at localhost

On Wed, 2005-02-16 at 18:49 +0100, Frank K?ster wrote:
> I have a couple of home-made logcheck ignore files, and happened to
> have one unescaped (and unmatched) `(' in one of the filter
> lines. Because of this, cron sent a mail with the body "grep: Invalid
> regular expression" - the subject is the command in the "2 * * *
*"
> line in /etc/cron.d/logcheck, of course.
> 
> It would be nice if logcheck would tell me in which file the error
> was. This should be easy, since egrep returns 1 if it finds no match
> and 2 with an invalid regular expression.
If you run logcheck in debug mode you'll be able to find out which file
the error is in.

For example, I added this to ignore.d.server/logcheck:

^\w{3} [ :0-9]{11} [._[:alnum:]-]+ foobar\[[0-9]+\]: test (foo test$

Running logcheck -otd gives:

[...]
D: [1108580515] cleanchecked - dir
- /tmp/logcheck.pFqP43/ignore/logcheck
grep: Invalid regular expression
[...]

I think this is what you're looking for?

-- 
-jamie <jamie at silverdream.org> | spamtrap: spam at silverdream.org
 w: http://www.silverdream.org | p: sms at silverdream.org
 pgp key @ http://silverdream.org/~jps/pub.key
 21:30:02 up 17 min,  2 users,  load average: 2.65, 2.52, 1.58

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url :
http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20050216/8d68f6df/attachment.pgp

On Fri, Feb 18, 2005 at 04:24:16AM +0000, Jamie L. Penman-Smithson
wrote:
> On Thu, 2005-02-17 at 22:26 -0500, Todd Troxell wrote:
> > Cool. I like this idea.  Expect to see it soon.
> 
> I fiddled with it and came up with:
[cut]

Error broke everything because it exit()s (which isn't obvious from it's
name)

It would be nice to replace error() with fatal() and also add a warn() for
echoing warnings to the report.

I think this will need to wait until after the release this weekend.

-- 
[   Todd J. Troxell                                         ,''`.
      Student, Debian GNU/Linux Developer, SysAdmin, Geek  : :' :
      http://debian.org || http://rapidpacket.com/~xtat    `. `' 
                                                             `-     ]

Your message dated Wed, 30 Mar 2005 21:17:08 -0500
with message-id <E1DGpF6-0002FL-00 at newraff.debian.org>
and subject line Bug#295560: fixed in logcheck 1.2.36
has caused the attached Bug report to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere.  Please contact me immediately.)

Debian bug tracking system administrator
(administrator, Debian Bugs database)

--------------------------------------
Received: (at submit) by bugs.debian.org; 16 Feb 2005 17:49:28
+0000
>From frank at kuesterei.ch Wed Feb 16 09:49:28 2005
Return-path: <frank at kuesterei.ch>
Received: from idmailgate2.unizh.ch [130.60.68.106] 
	by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
	id 1D1TIl-0004Q3-00; Wed, 16 Feb 2005 09:49:27 -0800
Received: from alhambra.kuesterei.ch ([130.60.169.112])
	by idmailgate2.unizh.ch (8.12.10/8.12.10/Debian-2) with ESMTP id j1GHnOfC002096
	for <submit at bugs.debian.org>; Wed, 16 Feb 2005 18:49:25 +0100
Received: from frank by alhambra.kuesterei.ch with local (Exim 3.36 #1 (Debian))
	id 1D1TIj-00036I-00
	for <submit at bugs.debian.org>; Wed, 16 Feb 2005 18:49:25 +0100
To: Debian Bug Tracking System <submit at bugs.debian.org>
Subject: logcheck: Please include filename when reporting "invalid regular
expression"
X-Debbugs-CC: Frank K?ster <frank at debian.org>
MIME-version: 1.0
Content-type: text/plain; charset=iso-8859-1
Message-Id: <E1D1TIj-00036I-00 at alhambra.kuesterei.ch>
From: =?iso-8859-1?Q?Frank_K=FCster?= <frank at kuesterei.ch>
Date: Wed, 16 Feb 2005 18:49:25 +0100
X-Virus-Scanned: by amavisd-new
Content-Transfer-Encoding: 8bit
Delivered-To: submit at bugs.debian.org
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02 
	(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-11.0 required=4.0 tests=BAYES_00,HAS_PACKAGE,
	X_DEBBUGS_CC autolearn=ham version=2.60-bugs.debian.org_2005_01_02
X-Spam-Level: 

Package: logcheck
Version: 1.2.34
Severity: wishlist

I have a couple of home-made logcheck ignore files, and happened to
have one unescaped (and unmatched) `(' in one of the filter
lines. Because of this, cron sent a mail with the body "grep: Invalid
regular expression" - the subject is the command in the "2 * * *
*"
line in /etc/cron.d/logcheck, of course.

It would be nice if logcheck would tell me in which file the error
was. This should be easy, since egrep returns 1 if it finds no match
and 2 with an invalid regular expression.

Regards, Frank



-- System Information:
Debian Release: 3.1
  APT prefers testing
  APT policy: (900, 'testing')
Architecture: i386 (i686)
Kernel: Linux 2.4.27
Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968)

Versions of packages logcheck depends on:
ii  adduser                       3.59       Add and remove users and groups
ii  cron                          3.0pl1-86  management of regular background p
ii  debconf [debconf-2.0]         1.4.30.11  Debian configuration management sy
ii  debianutils                   2.8.4      Miscellaneous utilities specific t
ii  exim [mail-transport-agent]   3.36-13    An MTA (Mail Transport Agent)
ii  lockfile-progs                0.1.10     Programs for locking and unlocking
ii  logcheck-database             1.2.34     A database of system log rules for
ii  logtail                       1.2.34     Print log file lines that have not
ii  mailutils [mailx]             1:0.6-2    GNU mailutils utilities for handli
ii  sysklogd [system-log-daemon]  1.4.1-16   System Logging Daemon

-- debconf information:
* logcheck/auto_create_logfiles: true
  logcheck/upgrade-note:
* logcheck/changes:
* logcheck/install-note:
* logcheck/email_address: root at localhost

---------------------------------------
Received: (at 295560-close) by bugs.debian.org; 31 Mar 2005 02:24:08
+0000
>From katie at ftp-master.debian.org Wed Mar 30 18:24:08 2005
Return-path: <katie at ftp-master.debian.org>
Received: from newraff.debian.org [208.185.25.31] (mail)
	by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
	id 1DGpLs-0006s3-00; Wed, 30 Mar 2005 18:24:08 -0800
Received: from katie by newraff.debian.org with local (Exim 3.35 1 (Debian))
	id 1DGpF6-0002FL-00; Wed, 30 Mar 2005 21:17:08 -0500
From: Todd Troxell <ttroxell at debian.org>
To: 295560-close at bugs.debian.org
X-Katie: $Revision: 1.55 $
Subject: Bug#295560: fixed in logcheck 1.2.36
Message-Id: <E1DGpF6-0002FL-00 at newraff.debian.org>
Sender: Archive Administrator <katie at ftp-master.debian.org>
Date: Wed, 30 Mar 2005 21:17:08 -0500
Delivered-To: 295560-close at bugs.debian.org
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02 
	(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-6.0 required=4.0 tests=BAYES_00,HAS_BUG_NUMBER 
	autolearn=no version=2.60-bugs.debian.org_2005_01_02
X-Spam-Level: 

Source: logcheck
Source-Version: 1.2.36

We believe that the bug you reported is fixed in the latest version of
logcheck, which is due to be installed in the Debian FTP archive:

logcheck-database_1.2.36_all.deb
  to pool/main/l/logcheck/logcheck-database_1.2.36_all.deb
logcheck_1.2.36.dsc
  to pool/main/l/logcheck/logcheck_1.2.36.dsc
logcheck_1.2.36.tar.gz
  to pool/main/l/logcheck/logcheck_1.2.36.tar.gz
logcheck_1.2.36_all.deb
  to pool/main/l/logcheck/logcheck_1.2.36_all.deb
logtail_1.2.36_all.deb
  to pool/main/l/logcheck/logtail_1.2.36_all.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 295560 at bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Todd Troxell <ttroxell at debian.org> (supplier of updated logcheck
package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster at debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Wednesday, 30 Mar 2005 20:04:00 -0600
Source: logcheck
Binary: logcheck logtail logcheck-database
Architecture: source all
Version: 1.2.36
Distribution: unstable
Urgency: low
Maintainer: Debian logcheck Team <logcheck-devel at
lists.alioth.debian.org>
Changed-By: Todd Troxell <ttroxell at debian.org>
Description: 
 logcheck   - Mails anomalies in the system logfiles to the administrator
 logcheck-database - A database of system log rules for the use of log checkers
 logtail    - Print log file lines that have not been read
Closes: 295560 296096 298291 301415
Changes: 
 logcheck (1.2.36) unstable; urgency=low
 .
   jamie:
   * Update rules for gps 1.0>.
   * Add/update rules for innd.
   maks:
   * Add harmless pdns rule at server level.
   * Add rules for cups-lpd at level server.
   * Add violations.ignore.d/logcheck-dcc for the nightly dccifd reporting.
   * Add rule ignore.d.server/kernel for printer out of paper.
     (Closes: #298291)
   * Add one more apm rule for useless gdm logout message.
   * Add rules for 2 harmless dhcpd and dhclient messages.
   * Add cvsd, pam rules from Peter Palfrader <weasel at debian.org>.
   * Add ssh rule for timeout before authentication.
   * Check time of rotated logfile against already gzipped logfile.
     syslog-ng leaves old syslog.0 logfile in /var/log. (Closes: #296096)
   todd:
   * Add support for warnings in report
   * Update copyright dates
   * Warn on invalid regex (Closes: #295560)
   * Update udev for directories (Matt Brubeck) (Closes: #301415)
Files: 
 413fc7df7619779bf5be7169dd3f16a0 703 admin optional logcheck_1.2.36.dsc
 7d0502bd49d96f15c75350b400d31d47 92454 admin optional logcheck_1.2.36.tar.gz
 1ffd732d134b16d85dac2098dbdb1057 43720 admin optional logcheck_1.2.36_all.deb
 27c54567364a981400d2c6fed97e4473 60124 admin optional
logcheck-database_1.2.36_all.deb
 424e9b589413f54e8f978ceac3289289 26646 admin optional logtail_1.2.36_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (GNU/Linux)

iD8DBQFCS1va4u3oQ3FHP2YRAkZ1AKCwzmDPnTpaCMUDtXvwWMfYfY7PGQCePwly
+/QqD7WsxiPC6EzHE9ZIvvs=1//C
-----END PGP SIGNATURE-----