search for: alnum

...bunch more rules for Postfix. I've attached new rules files and patches are inline. The following patch is for violations.ignore.d: --- logcheck-postfix.orig 2004-06-21 20:11:14.000000000 +0100 +++ logcheck-postfix 2004-06-21 20:10:32.000000000 +0100 @@ -1,4 +1,8 @@ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd\[[0-9]+\]: warning: [^[:space:]]+: hostname [^[:space:]]+ verification failed: Host not found$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd\[[0-9]+\]: [[:alnum:]]+: reject: RCPT from [^[:space:]]+: [0-9]+ Client host rejected: cannot find your hostname, [^[:space:]]+; from=[...

...6 insertions(+), 1 deletions(-) diff --git a/rulefiles/linux/ignore.d.server/openvpn b/rulefiles/linux/ignore.d.server/openvpn index 2b4bfd6..d80f42f 100644 --- a/rulefiles/linux/ignore.d.server/openvpn +++ b/rulefiles/linux/ignore.d.server/openvpn @@ -75,6 +75,11 @@ ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ (openvpn|ovpn-[._[:alnum:]-]+)\[[[:digit:]]+\]:( ([-_.@[:alnum:]]+/)?[.[:digit:]]{7,15}:[[:digit:]]{2,5})? VERIFY (SCRIPT )?OK: depth=[[:digit:]]+, /[-:_./=@[:alnum:]]+$ ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ (openvpn|ovpn-[._[:alnum:]-]+)\[[[:digit:]]+\]:( ([-_.@[:alnum:]]+/)?[.[:digit:]]{...

...cularly want to see every day. The one line with the warning in it is questionable, so leave it in or out at your discretion. Also, my regex skills are not as good as they could be, so there are probably mistakes, or things that could be simplified more. Rules are below: ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ snort: .$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ snort: (\`|\\+)-.*$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ snort: alert_fragments: (INACTIVE|ACTIVE)$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ snort: alert_incomplete: (INACTIVE|ACTIVE)$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ snort: alert_large_fragme...

Package: logcheck Version: 1.2.23 Severity: normal Hello, I have: # /bin/cat ignore.d.server/cron ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ crontab\[[0-9]+\]: \([[:alnum:]-]+\) LIST \([[:alnum:]-]+\)$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ crontab\[[0-9]+\]: \([[:alnum:]-]+\) REPLACE \([[:alnum:]-]+\)$ and: # /bin/cat ignore.d.paranoid/cron ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ /USR/SBIN/CRON\[[0-9]+\]: \([[:alnum:]-]+\) CMD \(.*\)$ ^...

...7 ((none)) via eth0 > Jan 7 10:49:25 on-o dhcpd: DHCPREQUEST for 192.168.1.4 (192.168.1.1) from 08:00:46:33:55:77 ((none)) via eth0 > Jan 7 10:49:25 on-o dhcpd: DHCPACK on 192.168.1.4 to 08:00:46:33:55:77 ((none)) via eth0 But /etc/ignore.d.server/dhcp file is > ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd(-2.2.x|): DHCPACK on [.0-9]+ to [:[:alnum:]]+ (\([._[:alnum:]-]+\) |)via [.[:alnum:]]+$ the client host name do not include (). Logcheck do not ignore the dhcp client log line. My request is following lines add to /etc/ignore.d.server/dhcp. It ignore (none) client host name. ^\w{3} [ :...

I upgraded to 1.2.28, same results. Here are the rules I added. ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ perdition\[[0-9]+\]: Connect: ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pure-ftpd: [^[:space:]]+ \[NOTICE\] ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pure-ftpd: [^[:space:]]+ \[INFO\] ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ exact\[[0-9]+\]: ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ slapd\[[0-9]+\]: ^\w{3} [ :0-9]{11} [...

...anged, 1 insertions(+), 1 deletions(-) diff --git a/rulefiles/linux/ignore.d.server/openvpn b/rulefiles/linux/ignore.d.server/openvpn index c57e3cb..1ea6068 100644 --- a/rulefiles/linux/ignore.d.server/openvpn +++ b/rulefiles/linux/ignore.d.server/openvpn @@ -19,7 +19,7 @@ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ (openvpn|ovpn-[._[:alnum:]-]+)\[[0-9]+\]:( ([-_.[:alnum:]]+/)?[.[:digit:]]{7,15}:[[:digit:]]{2,5})? (Data|Control) Channel MTU parms \[[[:upper:]:0-9/ ]+\]$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ (openvpn|ovpn-[._[:alnum:]-]+)\[[0-9]+\]: Preserving previous TUN/TAP instance: [[:alnum:]-]+$ ^\w{3...

...ne, so my apologies if HTML also comes through) ------ Making HTML documentation ------ creating doc/manual/version.texi creating doc/manual/R-FAQ.html Unescaped left brace in regex is deprecated here (and will be fatal in Perl 5.32), passed through in regex; marked by <-- HERE in m/^\s+@([[:alnum:]][[:alnum:]\-]*)({ <-- HERE })?\s*/ at C:/Rtools/texinfo5/Texinfo/Parser.pm line 5441. Unescaped left brace in regex is deprecated here (and will be fatal in Perl 5.32), passed through in regex; marked by <-- HERE in m/^\s+@([[:alnum:]][[:alnum:]\-]*)({ <-- HERE })?\s*(\@(c|comment)((\@|...

...nf-2.0] 1.5.11 Debian configuration management sy logcheck-database recommends no packages. -- debconf information: logcheck-database/conffile-cleanup: false Since etch, courier is logging ssl connactions as imapd and not longer as imapd-ssl, so the Pattern +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ imapd-ssl: ... fails. For me it works to change ignore.d.server/courier-imap-ssl and violations.ignore.d/courier-imap-ssl, i changed "imapd-ssl" to "imapd(-ssl)?" so both versions match. --- ignore.d.server/courier-imap-ssl.old 2007-05-25 10:33:52.000000000 +0200...

...dds support for log lines of the following format: May 30 19:36:57 server dhcpd: DHCPACK to 10.10.10.10 (aa:bb:cc:dd:ee:ff) via eth1 Regards, Robbert --- /root/dhcp 2006-05-30 21:50:24.000000000 +0200 +++ dhcp 2006-05-30 23:27:06.000000000 +0200 @@ -18,7 +18,7 @@ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd: DHCPACK on [.0-9]{7,15} to [:[:alnum:]]+ (\([._[:alnum:]-]+\) |)via [.[:alnum:]]+$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd: DHCPINFORM from [.0-9]{7,15} via [.[:alnum:]]+$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd: DHCPRELEASE of [.0-9]{7,15} from [:[:alnum:]]+ (\([._[:alnum:]-]+\) |)...

...anged, 1 insertions(+), 1 deletions(-) diff --git a/rulefiles/linux/ignore.d.server/openvpn b/rulefiles/linux/ignore.d.server/openvpn index 68ebf8f..c57e3cb 100644 --- a/rulefiles/linux/ignore.d.server/openvpn +++ b/rulefiles/linux/ignore.d.server/openvpn @@ -13,7 +13,7 @@ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ (openvpn|ovpn-[._[:alnum:]-]+)\[[0-9]+\]:( ([-_.[:alnum:]]+/)?[.[:digit:]]{7,15}:[[:digit:]]{2,5})? SIGUSR1\[soft,(ping-restart|connection-reset)\] received, (process|client-instance) restarting$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ (openvpn|ovpn-[._[:alnum:]-]+)\[[0-9]+\]: Restart pause, [[:di...

...insertions(+), 4 deletions(-) diff --git a/rulefiles/linux/ignore.d.server/postfix b/rulefiles/linux/ignore.d.server/postfix index be14415..2a6b554 100644 --- a/rulefiles/linux/ignore.d.server/postfix +++ b/rulefiles/linux/ignore.d.server/postfix @@ -29,10 +29,10 @@ ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ postfix/policy-spf\[[[:digit:]]+\]: : SPF pass: smtp_comment=.*: [.[:alnum:]]+ MX [.[:alnum:]]+ A [[:digit:]a-f.:]+, header_comment=[.[:alnum:]]+: domain of [%[:punct:][:alnum:]]+@[.[:alnum:]]+ designates [[:xdigit:].:]{3,39} as permitted sender$ ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ postf...

...wrong network." appended, when a client requested an ip adress out of a different domain, which will result in a DHCPNAK. This is a common case with WLAN users i think. I also added rules for dyndns support by dhcpd. The modified rules are: # Dyndns support for DHCP ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd: [Aa]dded (new )?(forward|rewerse) map from [._[:alnum:]-]+ to [._[:alnum:]-]+$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd: Can't update forward map [._[:alnum:]-]+ to [.0-9]+: no such RRset$ # Added load-balancing statements and hostname characters ._- ^\w{3} [ :0-9]{11} [._[:alnum:]-...

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, I think I found a mistake in the postfix file in /etc/logcheck/ignore.d.server. There is one equal sign to much in this line: ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd\[[0-9]+\]: [[:alnum:]]+: client=[^[:space:]]+, sasl_method=[[:alnum:]]+, sasl_username==[-_.@[:alnum:]]+$ I think it should be: ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd\[[0-9]+\]: [[:alnum:]]+: client=[^[:space:]]+, sasl_method=[[:alnum:]]+, sasl_username=[-_.@[:aln...

package logcheck-database tags 125794 pending tags 191637 pending thanks I've been running the latest version of qpopper from unstable for a few days and I've added the following rules to CVS: ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ in.qpopper\[[0-9]+\]: connect from [._[:alnum:]-]+$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ in.qpopper\[[0-9]+\]: \(v[.[:digit:]]+\) POP login by user \"[@._[:alnum:]-]+\" at \([._[:alnum:]-]+\) [.[:digit:]]+ \[pop_log.c:244\]$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ in.qpopper\[[0-9]+\]: \[dr...

Are there technical reasons that package names cannot be snake case? This seems to be enforced by `.standard_regexps()$valid_package_name` which currently returns "[[:alpha:]][[:alnum:].]*[[:alnum:]]" Is there any technical reason this couldn't be altered to accept `_` as well, e.g. "[[:alpha:]][[:alnum:]._]*[[:alnum:]]" I realize that historically `_` has not always been valid in variable names, but this has now been acceptable for 15+ years (since R 1.9...

Package: logcheck-database Version: 1.2.42 Severity: normal Tags: patch Index: postfix =================================================================== --- postfix (revision 1097) +++ postfix (working copy) @@ -44,7 +44,7 @@ # Postfix < 2.1 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtp\[[0-9]+\]: connect to [^[:space:]]+: server dropped connection without sending the initial greeting \(port 25\)$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtp\[[0-9]+\]: [[:alnum:]]+: to=\<.*\>, relay=[^[:space:]]+\], status=deferred \(host [^[:space:]]+\] said: .*$ -^\w{...

Package: logcheck-database Version: 1.2.32 Severity: wishlist Ignore rules to supress messages generated from pugging in, and then removing, a USB headset (one speaker). ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: drivers\/usb\/class\/audio\.c: v1.0.0:USB Audio Class driver$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: usbaudio: assuming that a stereo channel connected directly to a mixer is missing in search.*$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: usbaudio: constructing mixer for Terminal [...

...rasp, but I am having difficulties removing ALL of the instances or 1. or 2. The code below removes just a SINGLE instance of the target string, but I was expecting it to remove all instances as I have \\*.[[allnum]]. I did try \\*.[[allnum]]*, but this did not work. form<-sub("\\+*\\s*[[:alnum:]]*\\s*\\*.[[:alnum:]]", "", form) I am obviously still not understanding something. If the list could offer some guidance I would be most grateful. Regards Mike Griffiths -- *Michael Griffiths, Ph.D *Statistician *Upstream Systems* 8th Floor Portland House Bressenden Place...

Package: logcheck-database Version: 1.2.32 Severity: normal Tags: patch The fix for 283331 exposed a bug in the dnsmasq rules. The rule was looking for DHCPINFO, but the actual message is DHCPINFORM. Prior to the 283331 fix, the old rule worked, because the "[()[:alnum:]]+" part of the rule matched the "RM" at the end of DHCPINFORM. -- System Information: Debian Release: 3.1 APT prefers testing APT policy: (500, 'testing') Architecture: i386 (i686) Kernel: Linux 2.6.8-1-k7 Locale: LANG=en_CA, LC_CTYPE=en_CA (charmap=ISO-8859-1) Versio...