Paweł Hajdan, Jr.
2011-Jan-01 16:38 UTC
[Logcheck-devel] Bug#608574: [PATCH] updated rules for dnsmasq
Package: logcheck I'm running dnsmasq-2.52 on a Gentoo Linux server, and the default rules for dnsmasq needed a few minor updates. See attached patch for suggested changes. Here are the relevant log lines: Jan 1 12:07:11 hq dnsmasq-dhcp[4093]: DHCPNAK(eth0) 192.168.20.107 00:26:37:a0:75:57 wrong server-ID Jan 1 12:28:39 hq dnsmasq-dhcp[4093]: DHCPNAK(eth0) 192.168.20.107 00:26:37:a0:75:57 wrong server-ID Jan 1 12:39:09 hq dnsmasq-dhcp[4093]: DHCPNAK(eth0) 192.168.20.107 00:26:37:a0:75:57 wrong server-ID Jan 1 15:27:36 hq dnsmasq-dhcp[4093]: Ignoring domain sternik.org.pl for DHCP host name (null) Jan 1 15:57:00 hq dnsmasq-dhcp[4093]: Ignoring domain sternik.org.pl for DHCP host name (null) Jan 1 17:02:13 hq dnsmasq-dhcp[4093]: Ignoring domain sternik.org.pl for DHCP host name (null) -------------- next part -------------- An embedded and charset-unspecified text was scrubbed... Name: 0001-More-complete-rules-for-dnsmasq.patch URL: <http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20110101/bad97de1/attachment.asc> -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 194 bytes Desc: OpenPGP digital signature URL: <http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20110101/bad97de1/attachment.pgp>
Paweł Hajdan, Jr.
2011-Sep-02 16:28 UTC
[Logcheck-devel] Bug#608574: Bug#608574: [PATCH] updated rules for dnsmasq
On 9/1/11 11:20 PM, Hannes von Haugwitz wrote:> Please explain why messages like "Ignoring domain" or "wrong server-ID" > are messages an administrator doesn't want to see at least once to react > accordingly (eg by adding local rules or fix the causing issue). In my > opinion logcheck should only filter those messages by default which are > just informational and aren't caused by an error.Right, I guess _some_ administrators may want to see those messages. However, in my opinion it's mostly noise. The machine in question was a part of a Windows domain I think, and when it connected to the DHCP server running logcheck, it tried to use the Windowsic configuration which resulted in those messages. There are already examples of arguably similar messages being ignored by logcheck, e.g. for cups-lpd: ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ cups-lpd\[[0-9]+\]: Unknown command-line option "\\" ignored!$ Please let me know if I can provide some more info. Thank you for careful checking of the filtering rules. -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 194 bytes Desc: OpenPGP digital signature URL: <http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20110902/79029be7/attachment.pgp>
Possibly Parallel Threads
- Bug#608256: /etc/logcheck/ignore.d.server/dnsmasq: dnsmasq: interface names are allowed to have a dash (-) please add this to the filter
- Bug#564702: [PATCH] rules suggestions for dhcpcd
- How to disable dnsmasq from starting automatically with libvirtd
- Bug#260743: logcheck-database: dhcp rule updates for failover support
- Bug#277636: logcheck-database: support for dnsmasq