[Logcheck-devel] Bug#296014: logcheck: ignore.d.server courier-pop 'DISCONNECTED' not matching

[Ingo Theiss]

> I couldn't find this rule anywhere, however I've added the following
> rule to CVS which matches the log message you gave:
>
> ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ courierpop3login: (TIMEOUT|
> DISCONNECTED), user=[-_.@[:alnum:]]+, ip=\[[.:[:alnum:]]+\],
> top=[[:digit:]]+, retr=[[:digit:]]+, time=[[:digit:]]+$
>
> Thanks for your report,

i figuered out the reason why you have not found the rule i mentioned.
the rule i mentioned is from a file named 'courier-pop' and this file
gets installed with the 'courier-pop' package (didn't know that)!

FILE
PACKAGE

etc/init.d/courier-pop
mail/courier-pop
etc/logcheck/ignore.d.server/courier-pop
mail/courier-pop
etc/logcheck/violations.ignore.d/courier-pop
mail/courier-pop

i am not that sophiticated with logcheck philosophy. but i think alle
rule files for logcheck should be centralized under the control of the
logcheck team. does every application provide it's own rule files?

that strange and confusing. should i open a bug against 'courier-pop'
for the wrong pattern? do i have to check every rule file if it's under
the control of the logcheck team or if it's a rule file provided by
another package?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20050220/312f48e0/attachment.htm 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 481 bytes
Desc: This is a digitally signed message part
Url : http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20050220/312f48e0/attachment.pgp