<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body>
<p dir="ltr" style="line-height: 1.38 ; margin-top: 0pt ; margin-bottom: 0pt" id="docs-internal-guid-5e9d86c8-529f-b708-fb7b-c62b0f0d4605"><span style="font-size: 11pt ; font-family: "arial" ; background-color: transparent ; vertical-align: baseline"><br class="kix-line-break" /></span><span style="font-size: 11pt ; font-family: "arial" ; background-color: transparent ; vertical-align: baseline">Hi everyone;</span><span style="font-size: 11pt ; font-family: "arial" ; background-color: transparent ; vertical-align: baseline"><br class="kix-line-break" /></span><span style="font-size: 11pt ; font-family: "arial" ; background-color: transparent ; vertical-align: baseline">After migrating to stretch, I can't get rid of certain messages via logcheck.</span></p><p dir="ltr" style="line-height: 1.38 ; margin-top: 0pt ; margin-bottom: 0pt"><span style="font-size: 11pt ; font-family: "arial" ; background-color: transparent ; vertical-align: baseline"><br class="kix-line-break" /></span><span style="font-size: 11pt ; font-family: "arial" ; background-color: transparent ; vertical-align: baseline">Jul 17 06:25:03 host liblogging-stdlog: [origin software="rsyslogd" swVersion="8.24.0" x-pid="326" x-info="<a href="http://www.rsyslog.com" target="_blank" rel="noopener noreferrer">http://www.rsyslog.com</a>"] rsyslogd was HUPed</span></p><span style="font-size: 11pt ; font-family: "arial" ; background-color: transparent ; vertical-align: baseline"><br class="kix-line-break" /></span><span style="font-size: 11pt ; font-family: "arial" ; background-color: transparent ; vertical-align: baseline">It appears in messages and syslog. I used to have my ignore rules working, as it was rsyslogd before, but now I can't. The following regex is in ignore.d.server/rsyslog and ignore.d.server/liblogging-stdlog and ignore.d.server/syslog (probably too much).</span><span style="font-size: 11pt ; font-family: "arial" ; background-color: transparent ; vertical-align: baseline"><br class="kix-line-break" /></span><span style="font-size: 11pt ; font-family: "arial" ; background-color: transparent ; vertical-align: baseline"><br class="kix-line-break" /></span><span style="font-size: 11pt ; font-family: "arial" ; background-color: transparent ; vertical-align: baseline">^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ liblogging-stdlog: \[origin software="rsyslogd" swVersion="[0-9.]+" x-pid="[[:digit:]]+"x-info="http:\/\/www\.rsyslog\.com"\] rsyslogd was HUPed$</span><span style="font-size: 11pt ; font-family: "arial" ; background-color: transparent ; vertical-align: baseline"><br class="kix-line-break" /></span><span style="font-size: 11pt ; font-family: "arial" ; background-color: transparent ; vertical-align: baseline"><br class="kix-line-break" /></span><span style="font-size: 11pt ; font-family: "arial" ; background-color: transparent ; vertical-align: baseline">Both configs successfully tested using logcheck-test. For instance:</span><span style="font-size: 11pt ; font-family: "arial" ; background-color: transparent ; vertical-align: baseline"><br class="kix-line-break" /></span><span style="font-size: 11pt ; font-family: "arial" ; background-color: transparent ; vertical-align: baseline"><br class="kix-line-break" /></span><span style="font-size: 11pt ; font-family: "arial" ; background-color: transparent ; vertical-align: baseline"># logcheck-test -l /var/log/messages liblogging-stdlog </span><span style="font-size: 11pt ; font-family: "arial" ; background-color: transparent ; vertical-align: baseline"><br class="kix-line-break" /></span><span style="font-size: 11pt ; font-family: "arial" ; background-color: transparent ; vertical-align: baseline">Jul 17 06:25:04 host liblogging-stdlog: [origin software="rsyslogd" swVersion="8.24.0" x-pid="326" x-info="<a href="http://www.rsyslog.com" target="_blank" rel="noopener noreferrer">http://www.rsyslog.com</a>"] rsyslogd was HUPed</span><span style="font-size: 11pt ; font-family: "arial" ; background-color: transparent ; vertical-align: baseline"><br class="kix-line-break" /></span><span style="font-size: 11pt ; font-family: "arial" ; background-color: transparent ; vertical-align: baseline">================================================================================</span><span style="font-size: 11pt ; font-family: "arial" ; background-color: transparent ; vertical-align: baseline"><br class="kix-line-break" /></span><span style="font-size: 11pt ; font-family: "arial" ; background-color: transparent ; vertical-align: baseline">parsed file: /var/log/messages</span><span style="font-size: 11pt ; font-family: "arial" ; background-color: transparent ; vertical-align: baseline"><br class="kix-line-break" /></span><span style="font-size: 11pt ; font-family: "arial" ; background-color: transparent ; vertical-align: baseline">used rule: 'liblogging-stdlog'</span><span style="font-size: 11pt ; font-family: "arial" ; background-color: transparent ; vertical-align: baseline"><br class="kix-line-break" /></span><span style="font-size: 11pt ; font-family: "arial" ; background-color: transparent ; vertical-align: baseline"><br class="kix-line-break" /></span><span style="font-size: 11pt ; font-family: "arial" ; background-color: transparent ; vertical-align: baseline">But... These lines are still being mailed to me as a warning. Am I using a wrong ignore file, or... ? :BUMP:</span><span style="font-size: 11pt ; font-family: "arial" ; background-color: transparent ; vertical-align: baseline"><br class="kix-line-break" /></span><span style="font-size: 11pt ; font-family: "arial" ; background-color: transparent ; vertical-align: baseline">Any ideas / help appreciated!</span> </body>
</html>