Logcheck devel - Nov 2006 - Bug#398257: logcheck-database: lots of "session opened" and "session closed" information

Package: logcheck-database
Version: 1.2.49
Severity: normal


My logcheck configuration is quite a default one, ignore level server. i found
the "session opened" and "session closed" ignore
lines in ignore.d.server/logcheck. but i still get those lines in the logcheck
mails:

Nov 12 17:17:01 server06 CRON[32741]: (pam_unix) session opened for user root by
(uid=0)
Nov 12 17:17:01 server06 CRON[32741]: (pam_unix) session closed for user root

i get them too for other users, not only root. I took a look at the regexes in
the logcheck ignore file, but i didn't see the problem. I've another
system
too also running debian etch which doesn't seem to have this problem. the
only difference the two systems that have is that the problematc
machine has syslog-ng (this is the only logging specific difference i'm
aware of).


juergen


-- System Information:
Debian Release: 4.0
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: i386 (i686)
Shell:  /bin/sh linked to /bin/bash
Kernel: Linux 2.6.17-2-k7
Locale: LANG=en_US, LC_CTYPE=en_US (charmap=ISO-8859-1) (ignored: LC_ALL set to
en_US)

Versions of packages logcheck-database depends on:
ii  debconf [debconf-2.0]         1.5.8      Debian configuration management sy

logcheck-database recommends no packages.

-- debconf information:
  logcheck-database/conffile-cleanup: false