[Logcheck-devel] Bug#623058: logcheck: tweak 'rsyslogd was HUPed' filter

[Karl Chen]

Package: logcheck
Version: 1.3.13
Severity: minor
Tags: patch


Hi, 

Logcheck reports messages of the form:

    Mar 15 06:25:26 foohost rsyslogd: [origin software="rsyslogd" swVersion="5.7.6" x-pid="3301" x-info="http://www.rsyslog.com"] rsyslogd was HUPed

I suggest the following tweak to /etc/logcheck/ignore.d.server/rsyslog:

diff -u /etc/logcheck/ignore.d.server/rsyslog /tmp/buffer-content-9511UCX
--- /etc/logcheck/ignore.d.server/rsyslog	2010-04-07 10:47:30.000000000 -0400
+++ /tmp/buffer-content-9511UCX	2011-04-16 18:51:37.000000000 -0400
@@ -2,4 +2,4 @@
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: Kernel logging \(proc\) stopped.$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ rsyslogd: \[origin software="rsyslogd" swVersion="[0-9.]+" x-pid="[0-9]+" x-info="http://www.rsyslog.com"\] \(re\)start$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ rsyslogd: \[origin software="rsyslogd" swVersion="[0-9.]+" x-pid="[0-9]+" x-info="http://www.rsyslog.com"\] exiting on signal [0-9]+.$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ rsyslogd: \[origin software="rsyslogd" swVersion="[0-9.]+" x-pid="[0-9]+" x-info="http://www.rsyslog.com"\] rsyslogd was HUPed, type '(restart|lightweight)'\.$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ rsyslogd: \[origin software="rsyslogd" swVersion="[0-9.]+" x-pid="[0-9]+" x-info="http://www.rsyslog.com"\] rsyslogd was HUPed(, type '(restart|lightweight)'\.)?$


Thanks,
Karl

-- System Information:
ii  rsyslog [system-log-daemon]   5.7.10-1   reliable system and kernel logging
ii  logcheck-database             1.3.13     database of system log rules for t