Bug#277644: [Logcheck-devel] Bug#277644: logcheck-database: ignore rules for removable media

[maks attems]

tags 277644 pending
thanks

On Thu, 21 Oct 2004, Lee Maguire wrote:

> These are some kernel ignore rules I use in the workstation setting
> relating to removable media (usb, zip, cdr).
> 
> 
> ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: Initializing USB Mass Storage driver\.\.\.$
merged
> ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: usbcore: registered new driver usb-storage$
changed a bit already merged rule:
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: usbcore: registered new driver
[[:lower:]-]+$
> ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: USB Mass Storage support registered.$
merged with a '\.'
> ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: scsi[0-9]+ : SCSI emulation for USB Mass Storage devices$
merged with existent rule:
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: scsi[0-9]+ : SCSI emulation for
(IEEE-1394 SBP-2 Devices|USB Mass Storage devices)$
> ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: SCSI device sd[a-z]: [0-9]+ 512-byte hdwr sectors \([0-9]+ MB\)$
> ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: sd[a-z]: Write Protect is off$
merged
> ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: Mode Sense: [ 0-9]{11}$
> ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: assuming drive cache: write through$
couldn't reproduce those 2, no messages to match again.
for now left.
> ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: Attached scsi removable disk sd[a-z] at scsi[0-9], channel [0-9], id [0-9], lun [0-9]$
> ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: ISOFS: changing to secondary root$
merged
> ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: ide-floppy driver .*$
merged without '.*'
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: ide-floppy driver [[:alnum:].]+$
> ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: hd[a-z]: tray open$
hmm is that harmless?
no message to match against.
> ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ usb\.agent\[[0-9]+\]:[[:space:]]+usb-storage: loaded successfully$
> ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ scsi\.agent\[[0-9]+\]: disk at /devices/.*
both merged.

thanks for your bugreport and patience. :)
--
maks