[Logcheck-commits] Frédéric Brière : Corrected xdm pam_session rules

[Frédéric Brière]

Module: logcheck
Branch: master
Commit: 5d5442d749f02dd373df76e226d723ab81f19c87
URL:    http://git.debian.org/?p=logcheck/logcheck.git;a=commit;h=5d5442d749f02dd373df76e226d723ab81f19c87

Author: Frédéric Brière <fbriere at fbriere.net>
Date:   Mon Aug 17 15:36:18 2009 -0400

Corrected xdm pam_session rules

---

 debian/changelog                         |    1 +
 rulefiles/linux/ignore.d.workstation/xdm |    4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/debian/changelog b/debian/changelog
index a450b16..826cf0f 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -5,6 +5,7 @@ logcheck (1.3.4) experimental; urgency=low
   * Added USB kernel rules for USB_ANNOUNCE_NEW_DEVICES
   * Merged USB "new device" and "reset device" rules
   * Ignore "UDP: bad checksum" and "UDP: short packet" kernel messages
+  * Corrected xdm pam_session rules
 
  -- Frédéric Brière <fbriere at fbriere.net>  Mon, 17 Aug 2009 11:48:08 -0400
 
diff --git a/rulefiles/linux/ignore.d.workstation/xdm b/rulefiles/linux/ignore.d.workstation/xdm
index 3ed4900..e036a48 100644
--- a/rulefiles/linux/ignore.d.workstation/xdm
+++ b/rulefiles/linux/ignore.d.workstation/xdm
@@ -1,4 +1,4 @@
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+[[:space:]]+: \(pam_[[:alnum:]]+\) session opened for user [[:alnum:]-]+ by \(uid=[0-9]+\)$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+[[:space:]]+: \(pam_[[:alnum:]]+\) session closed for user [[:alnum:]-]+$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ xdm: :0\[[0-9]+\]: pam_[[:alnum:]]+\(xdm:session\): session opened for user [[:alnum:]-]+ by \(uid=[0-9]+\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ xdm: :0\[[0-9]+\]: pam_[[:alnum:]]+\(xdm:session\): session closed for user [[:alnum:]-]+$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ xdm(: :0)?\[[0-9]+\]: pam_[[:alnum:]]+\(xdm:session\): session opened for user [[:alnum:]-]+ by ([[:alnum:]-]+)?\(uid=[0-9]+\)$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ xdm(: :0)?\[[0-9]+\]: pam_[[:alnum:]]+\(xdm:session\): session closed for user [[:alnum:]-]+$