Stephan Niemz
2005-Apr-05 08:33 UTC
[Logcheck-devel] Bug#303176: /etc/logcheck/ignore.d.server/bind: changed log message in bind9 9.3.1-2
Package: logcheck-database
Version: 1.2.35
Severity: normal
File: /etc/logcheck/ignore.d.server/bind
Tags: patch
When upgrading bind9 from version 1:9.2.5-1 to 1:9.3.1-2, the syslog
messages of the type
Apr 4 07:49:37 gauss named[2179]: received notify for zone
'127.in-addr.arpa'
have changed to:
Apr 5 07:46:26 gauss named[29651]: client 127.0.0.1#34408: received notify for
zone '127.in-addr.arpa'
Please change /etc/logcheck/ignore.d.server/bind accordingly. Suggested
new entry there (hence the patch tag):
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: client [0-9.#]+: received
notify for zone '[._[:alnum:]-]+'$
Thanks,
- Stephan.
-- System Information:
Debian Release: 3.1
APT prefers unstable
APT policy: (500, 'unstable')
Architecture: i386 (i686)
Kernel: Linux 2.6.8-2-k7
Locale: LANG=en_GB.ISO-8859-15, LC_CTYPE=en_GB.ISO-8859-15 (charmap=ISO-8859-15)
Versions of packages logcheck-database depends on:
ii debconf [debconf-2.0] 1.4.47 Debian configuration management sy
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 268 bytes
Desc: Digital signature
Url :
http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20050405/877aa458/attachment.pgp
Jamie L. Penman-Smithson
2005-Apr-07 21:16 UTC
[Logcheck-devel] Bug#303176: /etc/logcheck/ignore.d.server/bind: changed log message in bind9 9.3.1-2
package logcheck-database tags 303176 pending thanks On Tue, 2005-04-05 at 10:33 +0200, Stephan Niemz wrote:> When upgrading bind9 from version 1:9.2.5-1 to 1:9.3.1-2, the syslog > messages of the type > > Apr 4 07:49:37 gauss named[2179]: received notify for zone '127.in-addr.arpa' > > have changed to: > > Apr 5 07:46:26 gauss named[29651]: client 127.0.0.1#34408: received notify for zone '127.in-addr.arpa'I've changed the rule in CVS to: ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: (client [.#[:digit:]]+: )?received notify for zone '[._[:alnum:]-]+'$ Which matches against the log messages above. Thanks for your bug report, -- -jamie <jamie at silverdream.org> | spamtrap: spam at silverdream.org w: http://www.silverdream.org | p: sms at silverdream.org pgp key @ http://silverdream.org/~jps/pub.key 21:30:02 up 17 min, 2 users, load average: 2.65, 2.52, 1.58 -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 189 bytes Desc: This is a digitally signed message part Url : http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20050407/2263a9b8/attachment.pgp
Debian Bug Tracking System
2005-Apr-07 21:33 UTC
[Logcheck-devel] Processed: Re: /etc/logcheck/ignore.d.server/bind: changed log message in bind9 9.3.1-2
Processing commands for control at bugs.debian.org:> package logcheck-databaseIgnoring bugs not assigned to: logcheck-database> tags 303176 pendingBug#303176: /etc/logcheck/ignore.d.server/bind: changed log message in bind9 9.3.1-2 Tags were: patch Tags added: pending> thanksStopping processing here. Please contact me if you need assistance. Debian bug tracking system administrator (administrator, Debian Bugs database)
Debian Bug Tracking System
2005-Apr-19 04:18 UTC
[Logcheck-devel] Bug#303176: marked as done (/etc/logcheck/ignore.d.server/bind: changed log message in bind9 9.3.1-2)
Your message dated Tue, 19 Apr 2005 00:02:12 -0400 with message-id <E1DNjwC-0002Fy-00 at newraff.debian.org> and subject line Bug#303176: fixed in logcheck 1.2.38 has caused the attached Bug report to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what I am talking about this indicates a serious mail system misconfiguration somewhere. Please contact me immediately.) Debian bug tracking system administrator (administrator, Debian Bugs database) -------------------------------------- Received: (at submit) by bugs.debian.org; 5 Apr 2005 08:36:01 +0000>From st.n at gmx.net Tue Apr 05 01:36:01 2005Return-path: <st.n at gmx.net> Received: from dialin-145-254-192-252.arcor-ip.net (gauss.linigo.de) [145.254.192.252] (Debian-exim) by spohr.debian.org with esmtp (Exim 3.35 1 (Debian)) id 1DIjXH-0008Jy-00; Tue, 05 Apr 2005 01:36:01 -0700 Received: from stephan by gauss.linigo.de with local (Exim 4.50 #1 (Debian)) id 1DIjV1-00040p-R2 for <submit at bugs.debian.org>; Tue, 05 Apr 2005 10:33:27 +0200 Date: Tue, 5 Apr 2005 10:33:27 +0200 From: Stephan Niemz <st.n at gmx.net> To: Debian Bug Tracking System <submit at bugs.debian.org> Subject: /etc/logcheck/ignore.d.server/bind: changed log message in bind9 9.3.1-2 Message-ID: <20050405083327.GA15112 at linigo.de> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="huq684BweRXVnRxX" Content-Disposition: inline X-Reportbug-Version: 3.9 Organization: http://Linigo.de/ User-Agent: Mutt/1.5.8i Delivered-To: submit at bugs.debian.org X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02 (1.212-2003-09-23-exp) on spohr.debian.org X-Spam-Status: No, hits=-6.0 required=4.0 tests=BAYES_00,HAS_PACKAGE, RCVD_IN_DSBL autolearn=no version=2.60-bugs.debian.org_2005_01_02 X-Spam-Level: --huq684BweRXVnRxX Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Package: logcheck-database Version: 1.2.35 Severity: normal File: /etc/logcheck/ignore.d.server/bind Tags: patch When upgrading bind9 from version 1:9.2.5-1 to 1:9.3.1-2, the syslog messages of the type Apr 4 07:49:37 gauss named[2179]: received notify for zone '127.in-addr.arpa' have changed to: Apr 5 07:46:26 gauss named[29651]: client 127.0.0.1#34408: received notify for zone '127.in-addr.arpa' Please change /etc/logcheck/ignore.d.server/bind accordingly. Suggested new entry there (hence the patch tag): ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: client [0-9.#]+: received notify for zone '[._[:alnum:]-]+'$ Thanks, - Stephan. -- System Information: Debian Release: 3.1 APT prefers unstable APT policy: (500, 'unstable') Architecture: i386 (i686) Kernel: Linux 2.6.8-2-k7 Locale: LANG=en_GB.ISO-8859-15, LC_CTYPE=en_GB.ISO-8859-15 (charmap=ISO-8859-15) Versions of packages logcheck-database depends on: ii debconf [debconf-2.0] 1.4.47 Debian configuration management sy --huq684BweRXVnRxX Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Digital signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (GNU/Linux) Comment: This is a digitally signed email. See http://gnupg.org/ for details. iD8DBQFCUk1XD4jPIYfdYgoRAht5AJ9nttkPtxXHT9oPaAaujUzWBrUCpQCcCqiu tR5DYWk0ikDryhX9M9FQ034=7IfW -----END PGP SIGNATURE----- --huq684BweRXVnRxX-- --------------------------------------- Received: (at 303176-close) by bugs.debian.org; 19 Apr 2005 04:09:42 +0000>From katie at ftp-master.debian.org Mon Apr 18 21:09:42 2005Return-path: <katie at ftp-master.debian.org> Received: from newraff.debian.org [208.185.25.31] (mail) by spohr.debian.org with esmtp (Exim 3.35 1 (Debian)) id 1DNk3S-0004vt-00; Mon, 18 Apr 2005 21:09:42 -0700 Received: from katie by newraff.debian.org with local (Exim 3.35 1 (Debian)) id 1DNjwC-0002Fy-00; Tue, 19 Apr 2005 00:02:12 -0400 From: Todd Troxell <ttroxell at debian.org> To: 303176-close at bugs.debian.org X-Katie: $Revision: 1.55 $ Subject: Bug#303176: fixed in logcheck 1.2.38 Message-Id: <E1DNjwC-0002Fy-00 at newraff.debian.org> Sender: Archive Administrator <katie at ftp-master.debian.org> Date: Tue, 19 Apr 2005 00:02:12 -0400 Delivered-To: 303176-close at bugs.debian.org X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02 (1.212-2003-09-23-exp) on spohr.debian.org X-Spam-Status: No, hits=-6.0 required=4.0 tests=BAYES_00,HAS_BUG_NUMBER autolearn=no version=2.60-bugs.debian.org_2005_01_02 X-Spam-Level: X-CrossAssassin-Score: 2 Source: logcheck Source-Version: 1.2.38 We believe that the bug you reported is fixed in the latest version of logcheck, which is due to be installed in the Debian FTP archive: logcheck-database_1.2.38_all.deb to pool/main/l/logcheck/logcheck-database_1.2.38_all.deb logcheck_1.2.38.dsc to pool/main/l/logcheck/logcheck_1.2.38.dsc logcheck_1.2.38.tar.gz to pool/main/l/logcheck/logcheck_1.2.38.tar.gz logcheck_1.2.38_all.deb to pool/main/l/logcheck/logcheck_1.2.38_all.deb logtail_1.2.38_all.deb to pool/main/l/logcheck/logtail_1.2.38_all.deb A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 303176 at bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Todd Troxell <ttroxell at debian.org> (supplier of updated logcheck package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster at debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Format: 1.7 Date: Monday, 18 Apr 2005 23:45:00 -0500 Source: logcheck Binary: logcheck logtail logcheck-database Architecture: source all Version: 1.2.38 Distribution: unstable Urgency: low Maintainer: Debian logcheck Team <logcheck-devel at lists.alioth.debian.org> Changed-By: Todd Troxell <ttroxell at debian.org> Description: logcheck - Mails anomalies in the system logfiles to the administrator logcheck-database - A database of system log rules for the use of log checkers logtail - Print log file lines that have not been read Closes: 30088 295352 297995 302678 303176 304978 Changes: logcheck (1.2.38) unstable; urgency=low . maks: * Generalise postfix rule concerning network_biopair_interop. * Add rule for ntp message about valid/infalid peers. (Closes #303661) * Improve rules .PHONY target + add checkpo rule for the translation check. * Add help target to debian/rules documenting the syntax. jamie: * Add rule in violations.ignore.d/logcheck-postfix for postgrey (Closes: #30088) * Modify bind notify rule for bind 9.3.x (Closes: #303176) * Add various workstation kernel/udev rules for removable devices (Closes: #297995) * Modify rsync rule to match module names with '.', '-' and '_'. Thanks to SATOH Fumiyasu <fumiya at samba.gr.jp> for the patch (Closes: #295352) * Add nagios rule for UNKNOWN state service notification. * Modify postfix anvil rule for 'max connection' statistics messages to match smtps connections too. * Add new rules for policyd, a postfix policy daemon. * Add more postfix rules for certificate verification failure messages. * Add new rules for postfix scache (connection cache server). * Add rule for bind 9.3 'unexpected RCODE' messages. * Modify dnsmasq rule to match '/var/run/dnsmasq/resolv.conf' too. (Closes: #302678) todd: * Change lockfile location from /var/lock/logcheck to /var/lock/logcheck/logcheck (Thanks Rainer Zocholl) to avoid potential DoS condition. (Closes: #304978) * Make lockfile debug messages refer to the correct files. * Add note about dh_installlogcheck permissions. (See #302379) Files: a040986cd3efb1bc4b4b273ed4a0e635 703 admin optional logcheck_1.2.38.dsc d82a1faa4198dfa7900e518f8b3581d3 94121 admin optional logcheck_1.2.38.tar.gz 520c27384c61dc06f55a9698c42b7bbf 44576 admin optional logcheck_1.2.38_all.deb 70e46d26fa902d29668d16f1f7186af4 61472 admin optional logcheck-database_1.2.38_all.deb 6931679c977e9f6025ebbd4e7ccca586 27374 admin optional logtail_1.2.38_all.deb -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.5 (GNU/Linux) iD8DBQFCZH8R4u3oQ3FHP2YRAlR7AJ9f78c4NhflMsODo+Ov+/zR5bWNZACeJy+n 3OqLY4B4e4FxveJ3bkIPBUU=riHA -----END PGP SIGNATURE-----