control: tags -1 + moreinfo
On Wed, 29 Aug 2012 07:03:36 +0200 Sven Fischer
<bugreport-deb...@linux4tw.de> wrote:
> Package: logcheck
> Version: 1.3.13
> Severity: normal
>
> In ignore.d.server/imapproxy the first two lines (LOGIN and LOGOUT) for the
> regex contain double quotes. These are too much, hence the regex does not
> work when used with syslog.
> Leaving them out, solves the problem.
>
> example syslog entries for imapproxyd, which should match with the logcheck
> rules for imapproxy:
> Aug 29 00:10:23 vserver1901 in.imapproxyd[22478]: LOGIN: 'i...@linux44tw.de'
> (127.0.0.1:41773) on existing sd [10]
> Aug 29 00:10:24 vserver1901 in.imapproxyd[22478]: LOGOUT: 'i...@linux44tw.de'
> from server sd [10]
>
> Original lines:
> ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ in.imapproxyd\[[0-9]+\]: LOGOUT:
> '"[_[:alnum:]-]+(@[-_.[:alnum:]]+)?"' from server sd \[[0-9]+\]$
> ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ in.imapproxyd\[[0-9]+\]: LOGIN:
> '"[_[:alnum:]-]+(@[-_.[:alnum:]]+)?"'
> \([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}:[0-9]+\) on (existing|new)
> sd \[[0-9]+\]$
>
> lines adjusted to work with the syslog entries from imapproxy:
> ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ in.imapproxyd\[[0-9]+\]: LOGOUT:
> '[_[:alnum:]-]+(@[-_.[:alnum:]]+)?' from server sd \[[0-9]+\]$
> ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ in.imapproxyd\[[0-9]+\]: LOGIN:
> '[_[:alnum:]-]+(@[-_.[:alnum:]]+)?'
> \([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}:[0-9]+\) on (existing|new)
> sd \[[0-9]+\]$
>
> Two quotation marks too much in each line. That's it.
It's a shame no-one replied to this bug report from 2012 - i wonder if
it is still valid?
