Package: logcheck-database
Version: 1.2.56
Severity: normal
File: /etc/logcheck/ignore.d.server/spamd
Lately, I've been seeing "spamd: report" lines showing up in the
logcheck emails. It seems their format has changed slightly. Below is
an updated regex to match the lines[1].
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ spamd\[[0-9]+\]: (spamd: )?result: [.YN] [
[:digit:]-]+ - ([._[:alnum:],]+
)?scantime=[0-9.]+,size=[0-9]+,(user=[^,]+,uid=[0-9]+,required_score=[0-9.]+,rhost=[._[:alnum:]-]+,raddr=[0-9.]+,rport=[0-9]+,)?mid=<[^[:space:]]+>,(rmid=<[^[:space:]]+>,)?(bayes=[.[:digit:]]+(e-[[:digit:]]+)?,)?autolearn=(ham|spam|no)
*$
Changes:
- Grouped the character class and space before 'scantime' and made it an
optional match
- Added the 'rmid' field, optionally. I'm not sure if it would appear
between the 'mid' and 'bayed' fields since I don't have bayes checking
enabled. It does appear immediately after the 'mid' field for me.
- Added ' *' before the EOL anchor since the rules now seem to have
trailing spaces.
James
[1] - Jun 20 23:24:34 succubus spamd[2804]: spamd: result: . 0 -
scantime=0.5,size=4022,user=jamessan,uid=1000,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=41571,mid=<[EMAIL
PROTECTED]>,rmid=<[EMAIL PROTECTED]>,autolearn=ham
-- System Information:
Debian Release: lenny/sid
APT prefers unstable
APT policy: (500, 'unstable'), (499, 'experimental')
Architecture: i386 (i686)
Kernel: Linux 2.6.21-1-686 (SMP w/1 CPU core)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash
Versions of packages logcheck-database depends on:
ii debconf [debconf-2.0] 1.5.13 Debian configuration management sy
logcheck-database recommends no packages.
-- debconf information:
logcheck-database/conffile-cleanup: false
logcheck-database/standard-rename-note:
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
