<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/3.2.4">
</HEAD>
<BODY>
Dear logcheck Team,<BR>
<BR>
sorry for choosing the direct contact I don't know if it's the correct way.<BR>
<BR>
I am using logcheck on a webserver where pureftp is installed for upload of content. Logcheck is working fine except for one ignore.d rule regarding the logout messages from pureftp.<BR>
<BR>
Logcheck is reporting lots (an I mean lots) of messages from the following type:<BR>
<BR>
Feb 5 06:02:45 web1 pure-ftpd: (www-0021-02@81.173.154.221) [INFO] Logout.<BR>
<BR>
<BR>
I found the ignore.d for pureftp, but it doesnt match the kind pureftp is reporting the Logout message: <BR>
<BR>
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pure-ftpd: \(\?@[._[:alnum:]-]+\) \[INFO\] Logout.$<BR>
<BR>
<BR>
My question is: Is it a wrong configuration of pureftp / syslog or has the ignore.d rule to be tweaked (is it a kind of bug)?<BR>
<BR>
<BR>
Thank you for your work an time reading my mail.<BR>
<BR>
Regards,<BR>
<BR>
Ingo
</BODY>
</HTML>