[Logcheck-devel] Bug#296110: logcheck: ignore.d.server pure-ftpd pattern for '[NOTICE] ... uploaded' not matching

[Jamie L. Penman-Smithson]

On Sun, 2005-02-20 at 12:10 +0100, Ingo Theiss wrote:
> the pattern in ignore.d.server pure-ftpd for '[NOTICE] ... uploaded' is
> not matching the following message:
> 
> Feb 18 23:06:18 example pure-ftpd: (test-9999-99 at 111.111.111.111) [NOTICE]
> /docroot/example.com//htdocs/guradia/plugin/net.php.smarty/libs/plugins/function.assign_debug_info.php
> uploaded  (1116 bytes, 7.47KB/sec)
> 
> maybe the double '//' is the problem.

The following rule matches those messages:

^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pure-ftpd:
\([._[:alnum:]-]+@[._[:alnum:]-]+\) \[NOTICE\] .+ (up|down)loaded
\([0-9]+ bytes, [0-9]+.[0-9]+KB/sec\)$

It's been in logcheck since 1.2.29, since you're using 1.2.34 you
shouldn't be seeing those messages..

Make sure you've got that rule in your ignore.d.server/pure-ftpd. Are
those messages showing up as Security Events? Are the permissions on
ignore.d.server/pure-ftpd okay?

-- 
-jamie <jamie at silverdream.org> | spamtrap: spam at silverdream.org
 w: http://www.silverdream.org | p: sms at silverdream.org
 pgp key @ http://silverdream.org/~jps/pub.key
 21:30:02 up 17 min,  2 users,  load average: 2.65, 2.52, 1.58

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url : http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20050220/a8879d16/attachment.pgp