similar to: Bug#437478: logcheck-database: No rules for puppet included

Package: logcheck Version: 1.2.47 Severity: wishlist I'm running logcheck with an extended set of regular expressions on a desktop system. The CPU load of this system is normally very low, around 3%-5%. When logcheck starts scanning the logs, the CPU usage increases to 100% for several minutes and working on the system becomes difficult. I would therefore be very happy about if a

Package: logcheck-database Version: 1.2.51 Severity: wishlist I'm backup my ldap with slapcat (from package slapd) and get a entry in syslog. Can you add to /etc/logcheck/ignore.d.server/slpad: ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ slapcat: bdb_db_init: Initializing BDB database$ -- System Information: Debian Release: 3.1 APT prefers experimental APT policy: (1, 'experimental')

Package: logcheck-database Version: 1.2.69 Severity: wishlist Hello, when newgrp (part of the package login) is used, I see messages like this in my syslog: Aug 27 23:36:16 debian64 newgrp[1975]: user `root' (login `root' on tty1) switched to group `backup' Aug 27 19:28:15 srv1 newgrp[10082]: user `root' (login `mazur' on pts/1) switched to group `backup' Aug 27

Package: logcheck-database Version: 1.2.54 Severity: minor -- System Information: Debian Release: 4.0 APT prefers stable APT policy: (990, 'stable'), (500, 'unstable') Architecture: i386 (i686) Shell: /bin/sh linked to /bin/bash Kernel: Linux 2.6.18.2-dp0 Locale: LANG=de_DE at euro, LC_CTYPE=de_DE at euro (charmap=ISO-8859-15) Versions of packages logcheck-database depends

Package: logcheck-database Version: 1.2.54 Severity: normal Tags: patch Logcheck fails to ignore certain lines generated by OpenVPN; the attached patch fixes several regular expressions: * OpenVPN does not print the full path to ifconfig or route (at least here) * The interface name can also contain dots and does not always start with "tun" * The startup messages now gets suppressed

Package: logcheck Version: 1.2.69 Severity: normal Tags: patch -- System Information: Debian Release: 5.0.3 APT prefers stable APT policy: (500, 'stable') Architecture: amd64 (x86_64) Kernel: Linux 2.6.30.4-vs2.3.0.36.14-pre4 (SMP w/2 CPU cores) Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/bash Versions of packages logcheck depends

Package: logcheck-database Version: 1.2.26 Severity: normal Hi, the file courier contains the line: ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pop3d-ssl: Unexpected SSL connection shutdown\.$ This triggers the security logcheck section because of the word "shutdown". Quick fix is to move or duplicate this line to violations.ignore.d/logcheck-courier. BTW: It looks like the courier package

Package: logcheck-database Version: 1.2.39 Severity: wishlist Hi, I'd like to add the following rule to /etc/logcheck/violations.ignore.d/logcheck-postfix : ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd?\[[0-9]+\]: NOQUEUE: reject: RCPT from [._[:alnum:]-]+\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\]: 554 <[._[:alnum:]-]+\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\]>:

Package: logcheck-database Version: 1.2.28 Severity: normal Hi, the Internet Software Consortium changed the name to Internet Systems Consortium. For a fix for the logcheck rules see the attachment. -- System Information: Debian Release: 3.0 APT prefers testing APT policy: (600, 'testing'), (100, 'unstable'), (1, 'experimental') Architecture: i386 (i686) Kernel:

Package: logcheck Version: 1.2.57 Severity: normal Tags: patch In ignore.d.server/postgrey, change: ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postgrey(\[[0-9]+\])?: action=.+, reason=.+, (delay=.+, )?client_name=.+, client_address=.+, sender=.*, recipient=.+ to: ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postgrey(\[[0-9]+\])?: ([0-9A-F]+: )?action=.+, reason=.+, (delay=.+, )?client_name=.+,

Package: logcheck-database Version: 1.2.35 Severity: wishlist If it were possible, please add rules to ignore SSH debug level messages like these: Mar 22 18:59:29 cante sshd[5673]: debug2: channel 4: rcvd adjust 66020 Mar 22 18:59:34 cante sshd[5673]: debug2: channel 4: window 32736 sent adjust 32800 Sometimes the SSH need to be run with DEBUG in order to pinpoint connection troubles and

Package: logcheck-database Version: 1.2.23 Severity: minor Hi, a couple of minor corrections to the dhcp rule sets: First of all, the hostname matching parts need to include the "._-" signs (maybe . is not needed but it might be). Then when using failover, log lines of type DHCPDISCOVER and DHCPREQUEST may be entailed by the string ": load balance to peer <somestring>".

Package: logcheck-database Version: 1.3.13 Severity: wishlist Hi, scponly-full (using 4.8-4.1) in Debian is compiled with additional support for rsync, unison and SVN. However, the logcheck rule is based on the original version and doesn't include those commands in the regexp. Please add those three commands to the regexp. Best regards, Markus -- System Information: Debian Release:

Package: logcheck-database Version: 1.2.49 Severity: normal Tags: patch Hi, with "UseReverseDNS off" in /etc/proftpd/proftpd.conf the IP is used instead of the hostname: ... (::ffff:aaa.bbb.ccc.ddd[::ffff:aaa.bbb.ccc.ddd]) ... The rules in /etc/logcheck/ignore.d.server/proftpd do not support colons in the hostname. The attached patch fixes this. Greetings, Gregor -- System

Package: logcheck Version: 1.2.54 Severity: normal In the file ignore.d.paranoid/cron there are the rules ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ CRON\[[0-9]+\]: \(pam_[[:alnum:]]+\) session opened for user [[:alnum:]-]+ by \(uid=[0-9]+\)$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ CRON\[[0-9]+\]: \(pam_[[:alnum:]]+\) session closed for user [[:alnum:]-]+$ to ignore lines like 10:17:01 at 04-03-2007 tooar

Package: logcheck-database Version: 1.2.36 Severity: wishlist Hello, I recently blew away my old logcheck-databse and lost a number of changes that i had made to postfix entries. The default database for postfix reports the following errors that do not seem to be important... Apr 2 13:00:19 terminus postfix/local[29516]: 574B9B3B9F: to=<doug at localhost>, relay=local, delay=13,

Package: logcheck Version: 1.2.62 Severity: wishlist Here are two rules for ddclient, a client for dynamic IP services such as DynDNS or DynIP: ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ddclient\[[[:digit:]]+\]: SUCCESS: updating [._[:alnum:]-]+: good: IP address set to [:[:xdigit:].]+$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ddclient\[[[:digit:]]+\]: WARNING: forcing update of [._[:alnum:]-]+ from

Package: logcheck Version: 1.2.43a Severity: normal -- System Information: Debian Release: testing/unstable APT prefers testing APT policy: (900, 'testing'), (800, 'unstable') Architecture: i386 (i586) Kernel: Linux 2.6.10 Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 Versions of packages logcheck depends on: ii adduser 3.77 Add and remove

Package: logcheck-database Version: 1.2.69 Severity: wishlist Please add the rule ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ postfix/bounce\[[[:digit:]]+\]: [:alnum:]+: sender delay notification: [:alnum:]+$ -- System Information: Debian Release: 5.0.5 APT prefers stable APT policy: (700, 'stable'), (650, 'testing') Architecture: i386 (i686) Kernel: Linux 2.6.26-2-686 (SMP

hello, the debconf configuration of logcheck was removed since woody release: as logcheck's user base is targeting server admins, we don't see the need of a debconf based question regarding the frequency of logcheck. beside once per day is a good default. a note was added to documentation README.Debian that this value may be changed in /etc/cron.d/logcheck. so these bugreports will be