Logcheck devel - Jan 2006 - Bug#346350: logcheck-database: dhcp3-server ignores need to include (none ) client host name

Package: logcheck-database
Version: 1.2.39
Severity: normal

I use dhcp3-server and a dhcp client which is Sony HDD video recorder
CoCoon. The client not return client host name.

In this case, dhcpd server assumed the client host name is (none).
Therefor dhcpd output log described below.
> Jan  7 10:49:24 on-o dhcpd: DHCPDISCOVER from 08:00:46:33:55:77 ((none))
via eth0
> Jan  7 10:49:25 on-o dhcpd: DHCPOFFER on 192.168.1.4 to 08:00:46:33:55:77
((none)) via eth0
> Jan  7 10:49:25 on-o dhcpd: DHCPREQUEST for 192.168.1.4 (192.168.1.1) from
08:00:46:33:55:77 ((none)) via eth0
> Jan  7 10:49:25 on-o dhcpd: DHCPACK on 192.168.1.4 to 08:00:46:33:55:77
((none)) via eth0
But /etc/ignore.d.server/dhcp file is
> ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd(-2.2.x|): DHCPACK on [.0-9]+ to
[:[:alnum:]]+ (\([._[:alnum:]-]+\) |)via [.[:alnum:]]+$
the client host name do not include ().
Logcheck do not ignore the dhcp client log line.

My request is following lines add to /etc/ignore.d.server/dhcp.
It ignore (none) client host name.
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd: DHCPDISCOVER from
[:[:alnum:]]+ \([:._[:alnum:]-()]+\) via [.[:alnum:]]+$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd: DHCPOFFER on [.0-9]+ to
[:[:alnum:]]+ \([._[:alnum:]-()]+\) via [.[:alnum:]]+$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd: DHCPREQUEST for [.0-9]+
(\([.0-9]+\) |)from [:._[:alnum:]-]+ \([[:alnum:]()]+\) via [.[:alnum:]]+$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd: DHCPACK on [.0-9]+ to
[:[:alnum:]]+ \([._[:alnum:]-()]+\) via [.[:alnum:]]+$


-- System Information:
Debian Release: 3.1
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: i386 (i686)
Kernel: Linux 2.6.8-2-686
Locale: LANG=ja_JP.UTF-8, LC_CTYPE=ja_JP.UTF-8 (charmap=UTF-8)

Versions of packages logcheck-database depends on:
ii  debconf [debconf-2.0]         1.4.30.13  Debian configuration
management sy

-- debconf information:
* logcheck-database/rules-directories-note:
* logcheck-database/standard-rename-note:
* logcheck-database/conffile-cleanup: true
* logcheck-database/security_level: server

tags 346350 pending
thanks

On 7 Jan 2006, at 09:37, Takuya Ono wrote:
> I use dhcp3-server and a dhcp client which is Sony HDD video recorder
> CoCoon. The client not return client host name.
>
> In this case, dhcpd server assumed the client host name is (none).
> Therefor dhcpd output log described below.
>
>> Jan  7 10:49:24 on-o dhcpd: DHCPDISCOVER from 08:00:46:33:55:77  
>> ((none)) via eth0
>> Jan  7 10:49:25 on-o dhcpd: DHCPOFFER on 192.168.1.4 to  
>> 08:00:46:33:55:77 ((none)) via eth0
>> Jan  7 10:49:25 on-o dhcpd: DHCPREQUEST for 192.168.1.4  
>> (192.168.1.1) from 08:00:46:33:55:77 ((none)) via eth0
>> Jan  7 10:49:25 on-o dhcpd: DHCPACK on 192.168.1.4 to  
>> 08:00:46:33:55:77 ((none)) via eth0
I've modified the dhcp rules to match the messages above, they are now:

^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd(-2.2.x|): (BOOTREQUEST| 
DHCPDISCOVER) from [:[:alnum:]]+ (\([\(\):._[:alnum:]-]+\) )?via [. 
[:alnum:]]+$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd(-2.2.x|): DHCPOFFER on [.0-9] 
{7,15} to [:[:alnum:]]+ (\([\(\)._[:alnum:]-]+\) )?via [.[:alnum:]]+$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd(-2.2.x|): DHCPREQUEST for [. 
0-9]{7,15} (\([.0-9]{7,15}\) )?from [:._[:alnum:]-]+ (\([\(\)._ 
[:alnum:]-]+\) )?via [.[:alnum:]]+
( unknown lease [.0-9]{7,15}\.)?$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd(-2.2.x|): DHCPACK on [.0-9] 
{7,15} to [:[:alnum:]]+ (\([\(\)._[:alnum:]-]+\) )?via [.[:alnum:]]+$

The changes will be included in the next release.

Thanks for your bug report,

-- 
-Jamie L. Penman-Smithson <jamie at silverdream.org>
  t: +44 1273 424795; f: +44 1273 424795
  PGP: C0A7 955E EED6 A309 23D7 863B C76A 26A3 F0DC FCA8
  never send mail to: oubliette.z at gmail.com


-------------- next part --------------
A non-text attachment was scrubbed...
Name: PGP.sig
Type: application/pgp-signature
Size: 186 bytes
Desc: This is a digitally signed message part
Url :
http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20060212/e0e29919/attachment.pgp

Processing commands for control at bugs.debian.org:
> tags 346350 pending
Bug#346350: logcheck-database: dhcp3-server ignores need to include (none )
client host name
There were no tags set.
Tags added: pending
> thanks
Stopping processing here.

Please contact me if you need assistance.

Debian bug tracking system administrator
(administrator, Debian Bugs database)