Re: logcheck regexp question

2006-10-12 Thread Kevin Mark
On Thu, Oct 12, 2006 at 07:29:04PM -0400, Roberto C. Sanchez wrote: > On Thu, Oct 12, 2006 at 03:36:43AM -0400, Kevin Mark wrote: > > Hi Roberto, > > I did 'Oct 11 22:06:01 miami /USR/SBIN/CRON[19062]: (root) CMD > > (/usr/sbin/getimage' > roberto.txt and used the regex that you did on > > the text

Re: logcheck regexp question

2006-10-12 Thread Roberto C. Sanchez
On Thu, Oct 12, 2006 at 03:36:43AM -0400, Kevin Mark wrote: > Hi Roberto, > I did 'Oct 11 22:06:01 miami /USR/SBIN/CRON[19062]: (root) CMD > (/usr/sbin/getimage' > roberto.txt and used the regex that you did on > the text and it matched[0]. That leads me to look elsewhere. Is this > supposed to mat

Re: logcheck regexp question

2006-10-12 Thread Kevin Mark
On Thu, Oct 12, 2006 at 12:05:51AM -0400, Roberto C. Sanchez wrote: > On Wed, Oct 11, 2006 at 10:59:31PM -0400, Kevin Mark wrote: > > > > > > Please excuse me while I go and beat head against a brick wall. > > reading debian-devel lately is torture enough x-) > > :-) > > But, argh!!! > > It st

Re: logcheck regexp question

2006-10-11 Thread Roberto C. Sanchez
On Wed, Oct 11, 2006 at 10:59:31PM -0400, Kevin Mark wrote: > > > > Please excuse me while I go and beat head against a brick wall. > reading debian-devel lately is torture enough x-) :-) But, argh!!! It still doesn't work: regex: ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ /USR/SBIN/CRON\[.*\]: \(ro

Re: logcheck regexp question

2006-10-11 Thread Kevin Mark
On Wed, Oct 11, 2006 at 09:43:22PM -0400, Roberto C. Sanchez wrote: > On Wed, Oct 11, 2006 at 09:35:57PM -0400, Kevin Mark wrote: > > On Wed, Oct 11, 2006 at 06:08:08PM -0400, Roberto C. Sanchez wrote: > > > I have the following line in /etc/logcheck/ignore.d.server/local: > > > > > > ^\w{3} [ :0-

Re: logcheck regexp question

2006-10-11 Thread Roberto C. Sanchez
On Wed, Oct 11, 2006 at 09:35:57PM -0400, Kevin Mark wrote: > On Wed, Oct 11, 2006 at 06:08:08PM -0400, Roberto C. Sanchez wrote: > > I have the following line in /etc/logcheck/ignore.d.server/local: > > > > ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ /USR/BIN/CRON\[.*\]: \(root\) CMD > > \(/usr/sbin/geti

Re: logcheck regexp question

2006-10-11 Thread Kevin Mark
On Wed, Oct 11, 2006 at 06:08:08PM -0400, Roberto C. Sanchez wrote: > I have the following line in /etc/logcheck/ignore.d.server/local: > > ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ /USR/BIN/CRON\[.*\]: \(root\) CMD > \(/usr/sbin/getimage > > The level in logcheck.conf is set to server. Still, these l

logcheck regexp question

2006-10-11 Thread Roberto C. Sanchez
I have the following line in /etc/logcheck/ignore.d.server/local: ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ /USR/BIN/CRON\[.*\]: \(root\) CMD \(/usr/sbin/getimage The level in logcheck.conf is set to server. Still, these lines show up in my logcheck messages every hour: Oct 11 17:06:01 miami /USR/SBI