Logcheck devel - Apr 2016 - Bug#822165: logcheck-database: regex wrong in linux/ignore.d.server/postfix

Package: logcheck-database
Version: 1.3.17

(This is also present in the current git version
f005f31cd54a907adc8cb61888987d2ab3ab2480.)

The following regex on line 149 of
rulefiles/linux/ignore.d.server/postfix looks incorrect:

^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ postfix/smtpd\[[[:digit:]]+\]: warning:
numeric result [[[:xdigit:].:]{3,39}]+ in address->name lookup for
[^[:space:]]+$

Specifically the part [[[:xdigit:].:]{3,39}]+ does not seem to match
anything useful, though technically it appears to be a valid POSIX
regular expression. GNU grep -E thinks it matches e.g. the strings
[444]] and 444]]], that is it has a character class that includes [
repeated 3-39 times and then a ] character one or more times.

I don't know which log messages this rule is supposed to match. Looking
at the expressions in the surrounding lines of that rule file, perhaps
the suspicious part should match an IPv4/IPv6 address, in which case the
outermost [ and ]+ should not be there. That is, perhaps the rule should
be:

^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ postfix/smtpd\[[[:digit:]]+\]: warning:
numeric result [[:xdigit:].:]{3,39} in address->name lookup for
[^[:space:]]+$

On the other hand, codesearch.debian.net seems to find only this rule
when searching for "address->name lookup for" and only comments
when
searching for "numeric result package:postfix". So maybe the log
message
isn't there at all anymore?

Your message dated Wed, 25 Jan 2017 22:05:37 +0000
with message-id <E1cWVhB-0002wq-41 at fasolo.debian.org>
and subject line Bug#822165: fixed in logcheck 1.3.18
has caused the Debian Bug report #822165,
regarding logcheck-database: regex wrong in linux/ignore.d.server/postfix
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner at bugs.debian.org
immediately.)


-- 
822165: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=822165
Debian Bug Tracking System
Contact owner at bugs.debian.org with problems
-------------- next part --------------
An embedded message was scrubbed...
From: rjs at netti.fi (Riku Saikkonen)
Subject: logcheck-database: regex wrong in linux/ignore.d.server/postfix
Date: Thu, 21 Apr 2016 20:34:17 +0300
Size: 3563
URL:
<http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20170125/1e88b3cc/attachment-0002.mht>
-------------- next part --------------
An embedded message was scrubbed...
From: Hannes von Haugwitz <hannes at vonhaugwitz.com>
Subject: Bug#822165: fixed in logcheck 1.3.18
Date: Wed, 25 Jan 2017 22:05:37 +0000
Size: 7772
URL:
<http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20170125/1e88b3cc/attachment-0003.mht>