Bug#253861: [Logcheck-devel] Bug#253861: logcheck: Please add support for imapproxy

maks attems debian at sternwelten.at
Fri Jun 11 22:15:05 UTC 2004


On Fri, 11 Jun 2004, Bojan Baros wrote:

> maks attems said:
> > could you please test the attached rules on your server.
> > put it inside /etc/logcheck/ignore.d.server
> > (assuming you are not using paranoid mode).
> > hope to read you soon.
> 
> It did not work.  I think there may be some spacing issues.

well so try to correct them. :)
 
> I have produced and tested my own regexpes, and they are attached to this
> email.

> ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ in.imapproxyd\[[0-9]+\]: LOGOUT: '"\w+"' from server sd \[[0-9]+\]
> ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ in.imapproxyd\[[0-9]+\]: LOGIN: '"\w+"' \([.0-9]+:[0-9]+\) on existing sd \[[0-9]+\]

i see, but 
*) those don't end with a '$', so don't match a hole line
*) \w+ is not sufficient for a username [_[:alnum:]-]+ is
*) [.0-9]+ for an ip should be at least [.0-9]{7,15}

please correct those issues in you rules 
or fix the ones i sent you.

i'll merge that to logcheck cvs.
a++ maks

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
Url : http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20040612/b105be06/attachment.pgp 


More information about the Logcheck-devel mailing list