Dan Le Bray
2010-Feb-09 13:44 UTC
[Logcheck-devel] Bug#569014: logcheck kernel rules don't match [<blank><number>.<number>]
Package: logcheck Version: 1.2.69 The current ruleset "kernel" provided with this logcheck package don't match entries where the kernel timeline has leading spaces, like: [ 42.302707] For example, the following entry: Feb 4 17:05:24 hostname kernel: [ 144.591487] tun: Universal TUN/TAP device driver, 1.6 didn't matched the re: ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel:( \[[[:digit:]]+\.[[:digit:]]+\])? tun: Universal TUN/TAP device driver, [.[:digit:]]+$ But did match after adding a " +?" in front of "[[:digit:]]+\.[[:digit:]]", giving the following re: ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel:( \[ +?[[:digit:]]+\.[[:digit:]]+\])? tun: Universal TUN/TAP device driver, [.[:digit:]]+$ I am using Debian GNU/Linux "lenny" 5.0.4 with kernel 2.6.26-2-amd64. -- Daniel Le Bray Centre de Ressources Informatiques Universite du Havre
Debian Bug Tracking System
2010-Feb-11 21:09 UTC
[Logcheck-devel] Bug#569014: marked as done (logcheck kernel rules don't match [<blank><number>.<number>])
Your message dated Thu, 11 Feb 2010 22:04:02 +0100 with message-id <4B7470C2.6040700 at vonhaugwitz.com> and subject line Re: [Logcheck-devel] Bug#569014: logcheck kernel rules don't match [<blank><number>.<number>] has caused the Debian Bug report #569014, regarding logcheck kernel rules don't match [<blank><number>.<number>] to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact owner at bugs.debian.org immediately.) -- 569014: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=569014 Debian Bug Tracking System Contact owner at bugs.debian.org with problems -------------- next part -------------- An embedded message was scrubbed... From: Dan Le Bray <daniel.le-bray at univ-lehavre.fr> Subject: logcheck kernel rules don't match [<blank><number>.<number>] Date: Tue, 09 Feb 2010 14:44:35 +0100 Size: 3145 URL: <http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20100211/33e3c3b7/attachment.eml> -------------- next part -------------- An embedded message was scrubbed... From: Hannes von Haugwitz <hannes at vonhaugwitz.com> Subject: Re: [Logcheck-devel] Bug#569014: logcheck kernel rules don't match [<blank><number>.<number>] Date: Thu, 11 Feb 2010 22:04:02 +0100 Size: 1946 URL: <http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20100211/33e3c3b7/attachment-0001.eml>
Reasonably Related Threads
- Bug#590679: [logcheck-database] rules for ntpd
- Bug#590559: updated rules for webmin
- Bug#546004: logcheck-database: logcheck kernel "Treason uncloaked" filter doesn't catch ipv6 addresses.
- Bug#566107: logcheck-database: with violations.d/logcheck empty most rules in violations.ignore.d look useless
- Bug#552222: logcheck: dhclient regexes need updating