Logcheck devel - Aug 2009 - Bug#542536: logcheck: [PATCH] new ntpd rule - kernel time sync status change

Package: logcheck
Version: 1.2.69
Severity: wishlist
Tags: patch


Examples:

    System Events
    =-=-=-=-=-=-    ...
    Aug 19 08:54:45 host ntpd[4008]: kernel time sync status change 4001
    Aug 19 09:11:48 host ntpd[4008]: kernel time sync status change 0001
    Aug 19 10:37:07 host ntpd[4008]: kernel time sync status change 4001
    Aug 19 10:54:12 host ntpd[4008]: kernel time sync status change 0001
    Aug 19 12:02:27 host ntpd[4008]: kernel time sync status change 4001
    ...

The following patch adds rule to match 'kernel time sync status change'
lines.

-- System Information:
Debian Release: squeeze/sid
  APT prefers testing
  APT policy: (990, 'testing'), (500, 'unstable')
Architecture: amd64 (x86_64)

Kernel: Linux 2.6.30-1-amd64 (SMP w/2 CPU cores)
Locale: LANG=en_DK.UTF-8, LC_CTYPE=en_DK.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages logcheck depends on:
ii  adduser            3.110                 add and remove users and groups
ii  bsd-mailx [mailx]  8.1.2-0.20081101cvs-2 A simple mail user agent
ii  cron               3.0pl1-106            process scheduling daemon
ii  exim4              4.69-11               metapackage to ease Exim MTA (v4) 
ii  exim4-daemon-light 4.69-11               lightweight Exim MTA (v4) daemon
ii  lockfile-progs     0.1.13                Programs for locking and unlocking
ii  logtail            1.2.69                Print log file lines that have not
ii  mailx              1:20081101-2          Transitional package for mailx ren
ii  sysklogd [system-l 1.5-5                 System Logging Daemon

Versions of packages logcheck recommends:
ii  logcheck-database             1.2.69     database of system log rules for t

Versions of packages logcheck suggests:
pn  syslog-summary                <none>     (no description available)

-- no debconf information
-------------- next part --------------
>From f0b066f3817acaa8b1d94a4347f9b593221c8ca1 Mon Sep 17 00:00:00 2001
From: Jari Aalto <jari.aalto at cante.net>
Date: Thu, 20 Aug 2009 08:42:35 +0300
Subject: [PATCH] rulefiles/linux/ignore.d.server/ntp: add rule - kernel time
sync status change


Signed-off-by: Jari Aalto <jari.aalto at cante.net>
---
 rulefiles/linux/ignore.d.server/ntp |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

diff --git a/rulefiles/linux/ignore.d.server/ntp
b/rulefiles/linux/ignore.d.server/ntp
index 21037ac..e584232 100644
--- a/rulefiles/linux/ignore.d.server/ntp
+++ b/rulefiles/linux/ignore.d.server/ntp
@@ -11,3 +11,4 @@
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: too many recvbufs allocated
\([0-9]+\)$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: Listening on interface
[-[:alnum:]]+, [:.[:xdigit:]]+#[[:digit:]]{1,5} (En|Dis)abled$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd(_initres)?\[[0-9]+\]: signal_no_reset:
signal [[:digit:]]+ had flags [[:xdigit:]]+$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: kernel time sync status
change
-- 
1.6.3.3

Hi,

at first we should clarify how to handle debian bug #498992.

Hannes

reassign 542536 ntp
thanks

Hi,

this was fixed in git version 6441b85 with attached patch.

The file ignore.d.server/ntp has been included in ntp package some time
ago, so it was deleted from logcheck-database by Fr?d?ric Bri?re in git
version 2e28b4e.

Hannes

-------------- next part --------------
A non-text attachment was scrubbed...
Name: ignore.d.server_ntp.patch
Type: text/x-diff
Size: 1001 bytes
Desc: not available
URL:
<http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20090830/d053b06f/attachment.patch>