[Logcheck-users] logcheck doesn't ignore messages matched by egrep -f

Vianney Lejeune via.lej at free.fr
Sun Apr 5 13:37:19 UTC 2009


Hello,

	I have this message in syslog that I'd like to ignore:

===
Apr  5 15:31:37 server77 upnpd[11728]:   TimerThreadRemove failed!
===

I use these rules to ignore it in a file located in ignore.d.server  
(which contains some other rules which work):

===
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ upnpd\[[0-9]+\]:    
TimerThreadRemove failed!$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ upnpd\[[0-9]+\]:[[:print:]]+$
===

The command egrep -f /etc/logcheck/ignore.d.server/rule /var/log/ 
syslog matches the message correctly but logcheck keeps sending me an  
email regarding this log entry. Is it a bug or did I miss something?

Regards,
Mr Lejeune




More information about the Logcheck-users mailing list