Logcheck devel - Feb 2005 - Bug#296017: logcheck: ignore.d.server pure-ftpd user with trailing whitespace

Package: logcheck
Version: 1.2.34
Severity: normal

the patterns for pure-ftpd in ignore.d.server are not matching a user
with a trailing whitespace. here a some examples:

Feb 18 13:02:33 web1 pure-ftpd: (stupid-pure-ftpd @84.56.131.73) [NOTICE]
/example/example.txt downloaded  (5908 bytes, 152196.03KB/sec)

Feb 18 13:16:14 web1 pure-ftpd: (stupid-pure-ftpd @84.56.131.73) [INFO]
Logout.

every rule is affected!

i have replaces the real username with 'stupid-pure-ftpd'. the trailing
whitespace seems to be a bug from  pure-ftpd. the user has definitely no
trailing whitespace, but pure-ftpd sometimes logs messages with a
trailing whitespace.

those behaviours lead to a previous question: why not providing a single
pattern which matches [INFO] and [NOTICE]. it's a pain for you the
maintainer(s) an the users to report every single exeption. what if
pure-ftpd changes it's behaviour in the next release? we have to start
over and over again to keep the patterns at a usable state. 

-- System Information:
Debian Release: 3.1
  APT prefers testing
  APT policy: (990, 'testing')
Architecture: i386 (i686)
Kernel: Linux 2.4.26
Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968)

Versions of packages logcheck depends on:
ii  adduser          3.59                    Add and remove users and groups
ii  cron             3.0pl1-86               management of regular background p
ii  debconf [debconf 1.4.30.11               Debian configuration management sy
ii  debianutils      2.8.4                   Miscellaneous utilities specific t
ii  exim4-daemon-hea 4.34-10                 Exim (v4) with extended features, 
ii  lockfile-progs   0.1.10                  Programs for locking and unlocking
ii  logcheck-databas 1.2.34                  A database of system log rules for
ii  logtail          1.2.34                  Print log file lines that have not
ii  mailx            1:8.1.2-0.20040524cvs-4 A simple mail user agent
ii  sysklogd [system 1.4.1-16                System Logging Daemon

-- debconf information:
  logcheck/changes:
* logcheck/install-note:

reassign 296017 pure-ftpd
retitle 296017 pure-ftpd: logging adds trailing whitespace to usernames
thanks

On Sat, 2005-02-19 at 19:19 +0100, Ingo Theiss wrote:
> the patterns for pure-ftpd in ignore.d.server are not matching a user
> with a trailing whitespace. here a some examples:
> 
> Feb 18 13:02:33 web1 pure-ftpd: (stupid-pure-ftpd @84.56.131.73) [NOTICE]
> /example/example.txt downloaded  (5908 bytes, 152196.03KB/sec)
<snip further examples>
>
> i have replaces the real username with 'stupid-pure-ftpd'. the
trailing
> whitespace seems to be a bug from  pure-ftpd. the user has definitely no
> trailing whitespace, but pure-ftpd sometimes logs messages with a
> trailing whitespace.
This is a bug in pure-ftpd that will (hopefully) be fixed in future
versions. Therefore I don't see a reason for changing the rules to
account for this, until it's fixed you can add a local rule to match
this.

Since this appears to be a pure-ftpd bug, I'm reassigning this to
pure-ftpd.
> those behaviours lead to a previous question: why not providing a single
> pattern which matches [INFO] and [NOTICE]. it's a pain for you the
> maintainer(s) an the users to report every single exeption. what if
> pure-ftpd changes it's behaviour in the next release? we have to start
> over and over again to keep the patterns at a usable state. 
The reason that we don't use a generic [INFO].* rule is that using .* to
match everything means that logcheck consumes greater resources when
matching against log messages. 

If you find further problems with any rules, submit them to the BTS.

Thanks,

-- 
-jamie <jamie at silverdream.org> | spamtrap: spam at silverdream.org
 w: http://www.silverdream.org | p: sms at silverdream.org
 pgp key @ http://silverdream.org/~jps/pub.key
 21:30:02 up 17 min,  2 users,  load average: 2.65, 2.52, 1.58

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url :
http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20050220/add1820c/attachment.pgp

Processing commands for control at bugs.debian.org:
> reassign 296017 pure-ftpd
Bug#296017: logcheck: ignore.d.server pure-ftpd user with trailing whitespace
Bug reassigned from package `logcheck' to `pure-ftpd'.
> retitle 296017 pure-ftpd: logging adds trailing whitespace to usernames
Bug#296017: logcheck: ignore.d.server pure-ftpd user with trailing whitespace
Changed Bug title.
> thanks
Stopping processing here.

Please contact me if you need assistance.

Debian bug tracking system administrator
(administrator, Debian Bugs database)