[Logcheck-commits] martin f. krafft: i.d.s/schroot: ignore new-style PAM session notices.

[Martin F. Krafft]

Module: logcheck
Branch: lenny-backports
Commit: c056845ae6f2512f144e9e76969cbc03ba5a91dd
URL:    http://git.debian.org/?p=logcheck/logcheck.git;a=commit;h=c056845ae6f2512f144e9e76969cbc03ba5a91dd

Author: martin f. krafft <madduck at debian.org>
Date:   Fri May 28 12:07:22 2010 +0200

i.d.s/schroot: ignore new-style PAM session notices.

Signed-off-by: martin f. krafft <madduck at debian.org>

---

 debian/changelog                        |    2 ++
 rulefiles/linux/ignore.d.server/schroot |    2 +-
 2 files changed, 3 insertions(+), 1 deletions(-)

diff --git a/debian/changelog b/debian/changelog
index 863fe62..2d51fe8 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -24,6 +24,8 @@ logcheck (1.3.9) UNRELEASED; urgency=low
     - fix rule to match greylisting notices.
   * ignore.d.server/ntop:
     - ignore warnings about truncated packets.
+  * ignore.d.server/schroot:
+    - ignore new-style PAM session notices.
 
  -- Hannes von Haugwitz <hannes at vonhaugwitz.com>  Fri, 14 May 2010 21:56:13 +0200
 
diff --git a/rulefiles/linux/ignore.d.server/schroot b/rulefiles/linux/ignore.d.server/schroot
index 5fef074..6c37bd2 100644
--- a/rulefiles/linux/ignore.d.server/schroot
+++ b/rulefiles/linux/ignore.d.server/schroot
@@ -1,3 +1,3 @@
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ schroot\[[[:digit:]]+\]: \(pam_unix\) session opened for user [-_.[:alnum:]]+ by ([-_.[:alnum:]]+)?\(uid=[[:digit:]]+\)$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ schroot\[[[:digit:]]+\]: (\(pam_unix\)|pam_unix\(schroot:session\):) session opened for user [-_.[:alnum:]]+ by ([-_.[:alnum:]]+)?\(uid=[[:digit:]]+\)$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ schroot\[[[:digit:]]+\]: \[[-._[:alnum:]]+ chroot\] \([-_.[:alnum:]]+->[-_.[:alnum:]]+\) Running login shell: '[-._/[:alnum:]]+'$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ schroot\[[[:digit:]]+\]: \[[-._[:alnum:]]+ chroot\] \([-_.[:alnum:]]+->[-_.[:alnum:]]+\) Running command: ".+"$