similar to: Bug#294950: logcheck: ignore.d.server courier imaplogin: DISCONNECTED not matching

Package: logcheck Version: 1.2.34 Severity: normal the patterns for pure-ftpd in ignore.d.server are not matching a user with a trailing whitespace. here a some examples: Feb 18 13:02:33 web1 pure-ftpd: (stupid-pure-ftpd @84.56.131.73) [NOTICE] /example/example.txt downloaded (5908 bytes, 152196.03KB/sec) Feb 18 13:16:14 web1 pure-ftpd: (stupid-pure-ftpd @84.56.131.73) [INFO] Logout. every

Dear logcheck Team, sorry for choosing the direct contact I don't know if it's the correct way. I am using logcheck on a webserver where pureftp is installed for upload of content. Logcheck is working fine except for one ignore.d rule regarding the logout messages from pureftp. Logcheck is reporting lots (an I mean lots) of messages from the following type: Feb 5 06:02:45 web1

Package: logcheck Version: 1.2.35 Severity: minor Manual page reads: SYNOPSIS logcheck [TIONS] Perhaps it was intended to read: SYNOPSIS logcheck [OPTIONS] -- System Information: Debian Release: testing/unstable APT prefers unstable APT policy: (500, 'unstable'), (500, 'stable'), (1, 'experimental') Architecture: i386 (i686) Shell: /bin/sh linked

Package: logcheck-database Version: 1.2.35 Severity: minor logcheck-database contain postgrey ignore file, but postgrey first attempt is listed in logcheck report $ dpkg -l postgrey ii postgrey 1.18-1 -- System Information: Debian Release: 3.1 APT prefers unstable APT policy: (500, 'unstable') Architecture: i386 (i686) Kernel: Linux 2.4.29-C3EZRA Locale: LANG=it_IT,

hello logcheck team, is there a reason why no dhclient patterns are provided in ignore.d.workstation? in ignore.d.server there are all necessery pattern for dhclient, but a workstation typicaly uses dhcp an those messages reported by logcheck are annoying. are there any good reasons not to include dhclient patterns in ignore.d.workstation or are they simply missed? thank you for any feedback!

Package: logcheck-database Version: 1.2.33 Severity: normal I just installed 1.2.33, and it made my rules dirs setuid, not setgid... - Marc -- System Information: Debian Release: 3.1 APT prefers testing APT policy: (900, 'testing'), (300, 'unstable') Architecture: i386 (i686) Kernel: Linux 2.6.8-1-k7 Locale: LANG=en_CA, LC_CTYPE=en_CA (charmap=ISO-8859-1) Versions of

Package: logcheck Version: 1.2.34 Severity: wishlist I have a couple of home-made logcheck ignore files, and happened to have one unescaped (and unmatched) `(' in one of the filter lines. Because of this, cron sent a mail with the body "grep: Invalid regular expression" - the subject is the command in the "2 * * * *" line in /etc/cron.d/logcheck, of course. It would be

Package: logcheck Version: 1.2.32 Severity: minor "Ghandi" should be "Gandhi" in README.how.to.interpret, assuming that you mean the Indian freedom fighter M.K. Gandhi a.k.a. Mahatma Gandhi. -- System Information: Debian Release: 3.1 APT prefers unstable APT policy: (500, 'unstable') Architecture: i386 (i686) Kernel: Linux 2.6.7 Locale: LANG=C, LC_CTYPE=C

Package: logcheck Version: 1.2.32 Severity: wishlist /etc/cron.daily/sysklogd restarts syslogd at the end of the script. This causes a daily log message, currently missed by logcheck: Jan 14 06:55:22 pyloric syslogd 1.4.1#16: restart (remote reception). I'm currently using this regex in ignore.server.d/local-syslogd: ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ syslogd 1\.4\.1#16: restart \(remote

Package: logcheck Version: 1.2.32 Severity: normal It seems when someone runs a sudo command on my system, logcheck misses it. The second line of /etc/logcheck/violations.d/sudo matches them, but the /etc/logcheck/violations.ignore.d/logcheck-sudo kills them. Furthermore, when users run commands like '$ sudo rm *' in a directory with lots of files, we reports with lines like: Jan 13

Package: logtail Version: 1.2.33 Severity: normal Hi... Logtail should not output error messages to standard output, since this violates the principle of least surprise. In particular, my application was broken by the semantics of logtail changing in version 1.2.21 (when you added switches for the default arguments to logtail). I think this was a bad move -- you broke an interface used by

Package: logcheck-database Version: 1.2.34 Severity: minor I have parallel port attached printer and kernel reports whenever printer is out of paper: Mar 6 12:38:50 host kernel: lp0 out of paper However, this is not a situation that should be reported by default (IMHO) by logcheck sending report email. Thus I propose adding following line to ignore.d.workstation/logcheck (possibly to .server

Package: logcheck Version: 1.2.35 Severity: minor Current manual reads: EXAMPLES logcheck can be invoked directly thanks to su(8) or sudo(8), which change the user ID: logcheck -o -t Check the logfiles without updating the offset. Print everything to STDOUT I believe this shuold be formatted as: EXAMPLES logcheck can be invoked directly thanks

Package: logcheck Version: 1.2.35 Severity: normal I'm getting the following on two different Unstable boxen: ------------------------------------------------------------------------------ Subject: Cron <logcheck at bandit-hall> if [ -x /usr/sbin/logcheck ]; then nice -n10 /usr/sbin/logcheck; fi

Package: logcheck-database Version: 1.2.35 Severity: wishlist If it were possible, please add rules to ignore SSH debug level messages like these: Mar 22 18:59:29 cante sshd[5673]: debug2: channel 4: rcvd adjust 66020 Mar 22 18:59:34 cante sshd[5673]: debug2: channel 4: window 32736 sent adjust 32800 Sometimes the SSH need to be run with DEBUG in order to pinpoint connection troubles and

Package: logcheck Version: 1.2.20a Severity: serious Tags: patch On a system where sh points to dash and LANG=es_ES, I get this: # apt-get -y --reinstall install logcheck Leyendo lista de paquetes... 0% Leyendo lista de paquetes... 0% Leyendo lista de paquetes... 23% Leyendo lista de paquetes... Hecho Creando ?rbol de dependencias... 0% Creando ?rbol de dependencias... 0% Creando ?rbol de

--nextPart2699335.H7BBWTdPIb Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline Hello :) After upgrading recently from Woody to Sarge (which went fairly well) I now= =20 have trouble with logcheck. I have been unable to track down a solution. Logcheck runs perfectly through the week until Sunday when logrotate does

Package: logcheck Version: 1.2.41 Severity: minor man (8) logcheck says: For hints on how to maintain rules, see README.logcheck-database.gz, but this file is not included in /usr/share/doc/logcheck. micah -- System Information: Debian Release: testing/unstable APT prefers unstable APT policy: (500, 'unstable') Architecture: i386 (i686) Shell: /bin/sh linked to /bin/bash Kernel:

Package: logcheck Version: 1.2.20a Severity: important Since logcheck changed to run as user logcheck, the error mails of the cron daemon end up in /var/mail/logcheck where nobody reads them. Mails for logcheck should be aliased to root like all the other mails of system accounts. I was searching for a long time what was wrong with my logcheck not delivering any mails. The lock directory was

Package: logcheck Version: 1.2.32 Severity: important In postinst logcheck "fixes" permissions of /etc/logcheck/* to 750. In my (and others on #d-d) opinion ownership and permissions should be preserved upon package upgrades. Logcheck must not screw with my decision to make them world readable every time it configures. -- Peter