Jan Evert van Grootheest
2009-Jan-02 09:21 UTC
[Logcheck-devel] Bug#510472: logcheck-database: pam_unix messages could be ignored.
Package: logcheck-database Version: 1.2.68 Severity: normal I'm using ldap to authenticate users. And thus pam_unix is sufficient, but allowed to fail. It has now started to spam the logs with lots of Jan 2 09:22:57 sisko sshd[28511]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=host92-22-static.38-79-b.business.telecomitalia.it user=root And on another system the same is happening for imapd. For a few weeks now I've added the below to the logcheck database to filter all those extra messages. It appears to have changed from a previous one, although I haven't bothered to look at the differences. ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ [[:alnum:]]+\[[0-9]+\]: pam_unix\([[:alnum:]]+:auth\): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=[\.0-9]+ user=[^[:space:]]+$ -- System Information: Debian Release: 5.0 APT prefers testing APT policy: (500, 'testing') Architecture: amd64 (x86_64) Kernel: Linux 2.6.27-7-server (SMP w/1 CPU core) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/bash -- debconf information: logcheck-database/standard-rename-note: logcheck-database/conffile-cleanup: false
Frédéric Brière
2009-Aug-19 00:24 UTC
[Logcheck-devel] Bug#510472: logcheck-database: pam_unix messages could be ignored.
On Fri, Jan 02, 2009 at 10:21:51AM +0100, Jan Evert van Grootheest wrote:> Package: logcheck-database > Version: 1.2.68 > > It has now started to spam the logs with lots of > Jan 2 09:22:57 sisko sshd[28511]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=host92-22-static.38-79-b.business.telecomitalia.it user=rootThis is a duplicate of #444470, which was fixed a while ago. (The fix was actually part of 1.2.64, so I'm assuming you filed this report from a different machine.)> And on another system the same is happening for imapd.Are we talking about cyrus-imapd-2.2? Could you provide an example? -- <elmo> Joy: thanks, joy <doogie> elmo: that's redundant, elmo <elmo> doogie: go play in traffic <doogie> ah, the elmo we know and love