[Logcheck-users] Can't ignore liblogging-stdlog anymore
Jeremy Nicoll - ml logcheck
jn.ml.lgc.089 at wingsandbeaks.org.uk
Fri Dec 8 07:57:12 UTC 2017
I'm replying to a messge I saw in the archive, and don't know
how (in the webmail system I'm using) to get the In-Reply-To
header set properly... so this reply probably won't thread
with the original question.
In July, adam oczo asked:
------------------------------------------------------
After migrating to stretch, I can't get rid of certain messages via
logcheck.
Jul 17 06:25:03 host liblogging-stdlog: [origin software="rsyslogd"
swVersion="8.24.0" x-pid="326" x-info="http://www.rsyslog.com"] rsyslogd
was HUPed
It appears in messages and syslog. I used to have my ignore rules
working, as it was rsyslogd before, but now I can't. The following regex
is in ignore.d.server/rsyslog and ignore.d.server/liblogging-stdlog and
ignore.d.server/syslog (probably too much).
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ liblogging-stdlog: \[origin
software="rsyslogd" swVersion="[0-9.]+"
x-pid="[[:digit:]]+"x-info="http:\/\/www\.rsyslog\.com"\] rsyslogd was
HUPed$
------------------------------------------------------
I might be wrong but I think the issue is that there's a space
missing in your regex, between the xpid and s-info sections.
--
Jeremy Nicoll - my opinions are my own
More information about the Logcheck-users
mailing list