Logcheck devel - Aug 2007 - Bug#437756: logcheck-database: bind violation.ignore rule for allow-query

Package: logcheck-database
Version: 1.2.54
Severity: wishlist

I have BIND set up as an authoritative server to the outside world, and
as a recursive server to myself.  Once or twice a day, someone will try
to resolve some external hostname through me, which I disallow via
allow-query.  BIND dutifully logs this, even though it doesn't interest
me in the least.

Here's a (violations) rule that filters these out:

  ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ named\[[[:digit:]]+\]: client
[[:digit:].]+#[[:digit:]]+: query \(cache\) '.*' denied$


-- System Information:
Debian Release: lenny/sid
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: i386 (i686)

Kernel: Linux 2.6.21-2-k7 (SMP w/1 CPU core)
Locale: LANG=en_CA.UTF-8, LC_CTYPE=en_CA.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash