search for: badver

...o my headache. If you insist on using an enumeration instead of ".*", here's the complete list (aside from NOERROR, obviously): ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: unexpected RCODE \((FORMERR|SERVFAIL|NXDOMAIN|NOTIMP|REFUSED|YXDOMAIN|YXRRSET|NXRRSET|NOTAUTH|NOTZONE|BADVERS|<rcode [[:digit:]]+>|[[:digit:]]+)\) resolving '[^[:space:]]+': [.[:digit:]]+#[0-9]+$ (Remember that this is both a violations and a normal ignore rule.) The source sets undefined rcodes such as 15 as "<rcode 15>", but they show up as merely "15" in my log...

...: 2001:503:ba3e::2:30#53 I believe that this line was intended to match it. ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ named\[[[:digit:]]+\]: ((network|host) (unreachable|down)|connection refused|unexpected RCODE \((FORMERR|SERVFAIL|NXDOMAIN|NOTIMP|REFUSED|YXDOMAIN|YXRRSET|NXRRSET|NOTAUTH|NOTZONE|BADVERS|<rcode [[:digit:]]+>|[[:digit:]]+)\)) resolving '[^[:space:]]+': [.:[:xdigit:]]+#[[:digit:]]+$ The Lenny form of the syslog line would have been: May 17 07:39:43 localhost named[2395]: network unreachable resolving '38.106.104.86.in-addr.arpa/PTR/IN': 2001:610:240:0:53::1...