Marc Sherman
2007-May-08 16:21 UTC
[Logcheck-devel] Bug#422884: logcheck: Cron logs message with "/usr/bin/crontab", not just "crontab"
Package: logcheck Version: 1.2.54 Severity: normal Tags: patch Cron is logging messages like: May 8 03:58:48 pyloric /usr/bin/crontab[387]: (root) LIST (nobody) but the logcheck pattern isn't expecting "/usr/bin/". - Marc -- System Information: Debian Release: 4.0 APT prefers stable APT policy: (500, 'stable') Architecture: i386 (i686) Shell: /bin/sh linked to /bin/bash Kernel: Linux 2.6.18-4-k7 Locale: LANG=en_CA, LC_CTYPE=en_CA (charmap=ISO-8859-1) Versions of packages logcheck depends on: ii adduser 3.102 Add and remove users and groups ii cron 3.0pl1-100 management of regular background p ii debconf 1.5.11 Debian configuration management sy ii exim4 4.63-17 metapackage to ease exim MTA (v4) ii exim4-daemon-hea 4.63-17 exim MTA (v4) daemon with extended ii grep 2.5.1.ds2-6 GNU grep, egrep and fgrep ii lockfile-progs 0.1.10 Programs for locking and unlocking ii logtail 1.2.54 Print log file lines that have not ii mailx 1:8.1.2-0.20050715cvs-1 A simple mail user agent ii sysklogd [system 1.4.1-18 System Logging Daemon Versions of packages logcheck recommends: ii logcheck-database 1.2.54 database of system log rules for t -- debconf information: logcheck/changes: * logcheck/install-note: -------------- next part -------------- --- /etc/logcheck/ignore.d.server/cron.orig 2007-05-08 12:14:16.000000000 -0400 +++ /etc/logcheck/ignore.d.server/cron 2007-05-08 12:15:05.000000000 -0400 @@ -1,4 +1,4 @@ -^\w{3} [ :0-9]{11} [._[:alnum:]-]+ crontab\[[0-9]+\]: \([[:alnum:]-]+\) LIST \([[:alnum:]-]+\)$ -^\w{3} [ :0-9]{11} [._[:alnum:]-]+ crontab\[[0-9]+\]: \([[:alnum:]-]+\) REPLACE \([[:alnum:]-]+\)$ -^\w{3} [ :0-9]{11} [._[:alnum:]-]+ crontab\[[0-9]+\]: \([[:alnum:]-]+\) (BEGIN|END) EDIT \([[:alnum:]-]+\)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ (/usr/bin/)?crontab\[[0-9]+\]: \([[:alnum:]-]+\) LIST \([[:alnum:]-]+\)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ (/usr/bin/)?crontab\[[0-9]+\]: \([[:alnum:]-]+\) REPLACE \([[:alnum:]-]+\)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ (/usr/bin/)?crontab\[[0-9]+\]: \([[:alnum:]-]+\) (BEGIN|END) EDIT \([[:alnum:]-]+\)$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ CRON\[[0-9]+\]: nss_ldap: reconnect(ing|ed) to LDAP server(\.\.\.| after [0-9]+ attempt\(s\))$