Package: logcheck-database Version: 1.2.54 Severity: wishlist In addition to seeing warnings from bind about REFUSED and SERVFAIL unexpected RCODE, I'm also getting from "15" in my logs as well, from various unrelated hosts. This doesn't occur nearly as frequently as the other two, but still enough to be annoying.
May I suggest inserting "(REFUSED|SERVFAIL|15)" in lieu of the current "(REFUSED|SERVFAIL)"? (Either that, or a [[:digit:]]+.) (Don't forget that this rule is both in server and violations.) -- System Information: Debian Release: lenny/sid APT prefers unstable APT policy: (500, 'unstable') Architecture: i386 (i686) Kernel: Linux 2.6.21-2-k7 (SMP w/1 CPU core) Locale: LANG=en_CA.UTF-8, LC_CTYPE=en_CA.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
