Logcheck devel - Jun 2007 - Bug#429886: /etc/logcheck/ignore.d.server/spamd: "result" filter update

Package: logcheck-database
Version: 1.2.56
Severity: normal
File: /etc/logcheck/ignore.d.server/spamd

Lately, I've been seeing "spamd: report" lines showing up in the
logcheck emails.  It seems their format has changed slightly.  Below is
an updated regex to match the lines[1].

^\w{3} [ :0-9]{11} [._[:alnum:]-]+ spamd\[[0-9]+\]: (spamd: )?result: [.YN] [
[:digit:]-]+ - ([._[:alnum:],]+
)?scantime=[0-9.]+,size=[0-9]+,(user=[^,]+,uid=[0-9]+,required_score=[0-9.]+,rhost=[._[:alnum:]-]+,raddr=[0-9.]+,rport=[0-9]+,)?mid=<[^[:space:]]+>,(rmid=<[^[:space:]]+>,)?(bayes=[.[:digit:]]+(e-[[:digit:]]+)?,)?autolearn=(ham|spam|no)
*$

Changes:
- Grouped the character class and space before 'scantime' and made it an
  optional match
- Added the 'rmid' field, optionally.  I'm not sure if it would
appear
  between the 'mid' and 'bayed' fields since I don't have
bayes checking
  enabled.  It does appear immediately after the 'mid' field for me.
- Added ' *' before the EOL anchor since the rules now seem to have
  trailing spaces.

James
[1] - Jun 20 23:24:34 succubus spamd[2804]: spamd: result: . 0 -
scantime=0.5,size=4022,user=jamessan,uid=1000,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=41571,mid=<200706210003.21082.white
at debian.org>,rmid=<uuOwAC.A.ZIC.pfaeGB at murphy>,autolearn=ham
-- System Information:
Debian Release: lenny/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (499, 'experimental')
Architecture: i386 (i686)

Kernel: Linux 2.6.21-1-686 (SMP w/1 CPU core)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash

Versions of packages logcheck-database depends on:
ii  debconf [debconf-2.0]         1.5.13     Debian configuration management sy

logcheck-database recommends no packages.

-- debconf information:
  logcheck-database/conffile-cleanup: false
  logcheck-database/standard-rename-note:

On Thu, Jun 21, 2007 at 02:09:39AM +0100, James Vega
wrote:
> Changes:
> - Added ' *' before the EOL anchor since the rules now seem to have
>   trailing spaces.
You forgot to mention that bayes is now a floating point (typically, but
not always, 1.000000).  That, and the trailing space, is why the current
rule doesn't matching anything in my case.


-- 
(It is an old Debian tradition to leave at least twice a year ...)
		-- Sven Rudolph