[Logcheck-commits] r1244 - in logcheck/trunk: debian
rulefiles/linux/cracking.d rulefiles/linux/ignore.d.server
rulefiles/linux/violations.d rulefiles/linux/violations.ignore.d
madduck at users.alioth.debian.org
madduck at users.alioth.debian.org
Wed Oct 18 18:08:00 UTC 2006
Author: madduck
Date: 2006-10-18 18:08:00 +0000 (Wed, 18 Oct 2006)
New Revision: 1244
Added:
logcheck/trunk/rulefiles/linux/cracking.d/smartd
logcheck/trunk/rulefiles/linux/violations.d/smartd
Modified:
logcheck/trunk/debian/changelog
logcheck/trunk/debian/logcheck-database.NEWS
logcheck/trunk/debian/logcheck-database.lintian-overrides
logcheck/trunk/rulefiles/linux/ignore.d.server/smartd
logcheck/trunk/rulefiles/linux/violations.ignore.d/logcheck-smartd
Log:
* */*smartd: now filters all smartd attribute changes except for temperature
changes to values higher than and equal to 55, and changes to the
attributes Reallocated_Sector_Ct, Current_Pending_Sector,
Offline_Uncorrectable, and UDMA_CRC_Error_Count. See
/usr/share/doc/logcheck-database/NEWS.Debian.gz .
Modified: logcheck/trunk/debian/changelog
===================================================================
--- logcheck/trunk/debian/changelog 2006-10-18 17:16:29 UTC (rev 1243)
+++ logcheck/trunk/debian/changelog 2006-10-18 18:08:00 UTC (rev 1244)
@@ -6,8 +6,13 @@
nevertheless.
* ignore.d.server/smartd: ignore messages smartd generates when sending
warning mail; thanks to Elmar Hoffmann (closes: #393938).
+ * */*smartd: now filters all smartd attribute changes except for temperature
+ changes to values higher than and equal to 55, and changes to the
+ attributes Reallocated_Sector_Ct, Current_Pending_Sector,
+ Offline_Uncorrectable, and UDMA_CRC_Error_Count. See
+ /usr/share/doc/logcheck-database/NEWS.Debian.gz .
- -- martin f. krafft <madduck at debian.org> Wed, 18 Oct 2006 19:12:21 +0200
+ -- martin f. krafft <madduck at debian.org> Wed, 18 Oct 2006 19:56:29 +0200
logcheck (1.2.48) unstable; urgency=low
Modified: logcheck/trunk/debian/logcheck-database.NEWS
===================================================================
--- logcheck/trunk/debian/logcheck-database.NEWS 2006-10-18 17:16:29 UTC (rev 1243)
+++ logcheck/trunk/debian/logcheck-database.NEWS 2006-10-18 18:08:00 UTC (rev 1244)
@@ -1,3 +1,33 @@
+logcheck-database (1.2.49) unstable; urgency=low
+
+ logcheck-database now filters all SMART attribute changes reported by
+ smartd, except for temperature changes (attribute 194) if the target value
+ is greater than or equal to 55 (these will be reported as system
+ alerts / violations.d), and changes to the following four attributes, which
+ will be reported as security alerts (cracking.d):
+
+ Reallocated_Sector_Ct
+ Current_Pending_Sector (when > 0 only)
+ Offline_Uncorrectable (when > 0 only)
+ UDMA_CRC_Error_Count
+
+ This decision was made based on several arguments, which have been brought
+ up as part of a mailing list discussion [0]. Among these were:
+
+ 1. smartd can send warning mails and is configured to do so by default on
+ Debian.
+
+ 2. attribute values are not standardised, so it is not possible to sensibly
+ filter out truly informational messages which are of no interest to the
+ administrator.
+
+ 3. logcheck does not have any context information and can thus not filter
+ attributes whose values simply oscillate.
+
+ [0] http://marc.theaimsgroup.com/?t=116015459000003&r=1&w=2
+
+ -- martin f. krafft <madduck at debian.org> Wed, 18 Oct 2006 19:57:18 +0200
+
logcheck-database (1.1.1-8) unstable; urgency=low
[This message was previously issued with debconf and has now been moved to
Modified: logcheck/trunk/debian/logcheck-database.lintian-overrides
===================================================================
--- logcheck/trunk/debian/logcheck-database.lintian-overrides 2006-10-18 17:16:29 UTC (rev 1243)
+++ logcheck/trunk/debian/logcheck-database.lintian-overrides 2006-10-18 18:08:00 UTC (rev 1244)
@@ -1,5 +1,7 @@
logcheck-database binary: non-standard-file-perm etc/logcheck/cracking.d/logcheck 0640 != 0644
+logcheck-database binary: non-standard-file-perm etc/logcheck/cracking.d/smartd 0640 != 0644
logcheck-database binary: non-standard-file-perm etc/logcheck/violations.d/logcheck 0640 != 0644
+logcheck-database binary: non-standard-file-perm etc/logcheck/violations.d/smartd 0640 != 0644
logcheck-database binary: non-standard-file-perm etc/logcheck/violations.d/su 0640 != 0644
logcheck-database binary: non-standard-file-perm etc/logcheck/violations.d/sudo 0640 != 0644
logcheck-database binary: non-standard-file-perm etc/logcheck/violations.ignore.d/logcheck-bind 0640 != 0644
Added: logcheck/trunk/rulefiles/linux/cracking.d/smartd
===================================================================
--- logcheck/trunk/rulefiles/linux/cracking.d/smartd (rev 0)
+++ logcheck/trunk/rulefiles/linux/cracking.d/smartd 2006-10-18 18:08:00 UTC (rev 1244)
@@ -0,0 +1,4 @@
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ smartd\[[0-9]+\]: Device: /dev/[^[:space:]]+( \[(3ware|cciss)_disk_[[:digit:]]+\])?, SMART Usage Attribute: 5 Reallocated_Sector_Ct changed from [[:digit:]]+ to [[:digit:]]+$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ smartd\[[0-9]+\]: Device: /dev/[^[:space:]]+( \[(3ware|cciss)_disk_[[:digit:]]+\])?, SMART Usage Attribute: 197 Current_Pending_Sector changed from [[:digit:]]+ to [1-9][[:digit:]]*$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ smartd\[[0-9]+\]: Device: /dev/[^[:space:]]+( \[(3ware|cciss)_disk_[[:digit:]]+\])?, SMART Usage Attribute: 198 Offline_Uncorrectable changed from [[:digit:]]+ to [1-9][[:digit:]]*$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ smartd\[[0-9]+\]: Device: /dev/[^[:space:]]+( \[(3ware|cciss)_disk_[[:digit:]]+\])?, SMART Usage Attribute: 199 UDMA_CRC_Error_Count changed from [[:digit:]]+ to [[:digit:]]+$
Modified: logcheck/trunk/rulefiles/linux/ignore.d.server/smartd
===================================================================
--- logcheck/trunk/rulefiles/linux/ignore.d.server/smartd 2006-10-18 17:16:29 UTC (rev 1243)
+++ logcheck/trunk/rulefiles/linux/ignore.d.server/smartd 2006-10-18 18:08:00 UTC (rev 1244)
@@ -1,7 +1,6 @@
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ smartd\[[0-9]+\]: Device: /dev/[^[:space:]]+( \[(3ware|cciss)_disk_[[:digit:]]+\])?, starting scheduled (Long|Short) Self-Test\.$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ smartd\[[0-9]+\]: Device: /dev/[^[:space:]]+( \[(3ware|cciss)_disk_[[:digit:]]+\])?, SMART Usage Attribute: 194 Temperature_Celsius changed from ([5-9]|[1-4][0-9]|50) to ([5-9]|[1-4][0-9]|50)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ smartd\[[0-9]+\]: Device: /dev/[^[:space:]]+( \[(3ware|cciss)_disk_[[:digit:]]+\])?, SMART Usage Attribute: 9 Power_On_Hours changed from [0-9]+ to [0-9]+$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ smartd\[[0-9]+\]: Device: /dev/[^[:space:]]+( \[(3ware|cciss)_disk_[[:digit:]]+\])?, Temperature changed (-|\+)?[1-3]+ Celsius to ([5-9]|[1-4][0-9]|50) Celsius since last report$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ smartd\[[0-9]+\]: Device: /dev/[^[:space:]]+( \[(3ware|cciss)_disk_[[:digit:]]+\])?, SMART (Prefailure|Usage) Attribute: [[:digit:]]+ [_[:alnum:]]+ changed from [[:digit:]]+ to [[:digit:]]+$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ smartd\[[0-9]+\]: Device: /dev/[^[:space:]]+( \[(3ware|cciss)_disk_[[:digit:]]+\])?, Temperature changed (-|\+)?[1-3]+ Celsius to ([0-4]?[0-9]|5[0-4]) Celsius since last report$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ smartd\[[0-9]+\]: Device: /dev/[^[:space:]]+( \[(3ware|cciss)_disk_[[:digit:]]+\])?, did test of type L in current hour, skipping test of type S$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ smartd\[[0-9]+\]: Sending warning via [^[:space:]]+ to [^[:space:]]+ \.\.\.$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ smartd\[[0-9]+\]: Warning via [^[:space:]]+ to [^[:space:]]+: successful$
Added: logcheck/trunk/rulefiles/linux/violations.d/smartd
===================================================================
--- logcheck/trunk/rulefiles/linux/violations.d/smartd (rev 0)
+++ logcheck/trunk/rulefiles/linux/violations.d/smartd 2006-10-18 18:08:00 UTC (rev 1244)
@@ -0,0 +1 @@
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ smartd\[[0-9]+\]: Device: /dev/[^[:space:]]+( \[(3ware|cciss)_disk_[[:digit:]]+\])?, SMART Usage Attribute: 194 Temperature_Celsius changed from [[:digit:]]+ to (([1-9][0-9]|[6-9])[0-9]|5[5-9])$
Modified: logcheck/trunk/rulefiles/linux/violations.ignore.d/logcheck-smartd
===================================================================
--- logcheck/trunk/rulefiles/linux/violations.ignore.d/logcheck-smartd 2006-10-18 17:16:29 UTC (rev 1243)
+++ logcheck/trunk/rulefiles/linux/violations.ignore.d/logcheck-smartd 2006-10-18 18:08:00 UTC (rev 1244)
@@ -1 +1,2 @@
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ smartd\[[0-9]+\]: Device: /dev/[^[:space:]]+( \[(3ware|cciss)_disk_[[:digit:]]+\])?, SMART Prefailure Attribute: [[:digit:]]+ [_[:alnum:]]+ changed from [[:digit:]]+ to [[:digit:]]+$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ smartd\[[0-9]+\]: Device: /dev/[^[:space:]]+( \[(3ware|cciss)_disk_[[:digit:]]+\])?, SMART Usage Attribute: 194 Temperature_Celsius changed from [[:digit:]]+ to ([0-4]?[0-9]|5[0-4])$
More information about the Logcheck-commits
mailing list