[Logcheck-devel] Bug#300888: logcheck-database: database skip postgrey ignore pattern

[Jamie L. Penman-Smithson]

tags 300888 pending
thanks

On Tue, 2005-03-22 at 17:37 +0100, Sythos wrote:
> On Tue, Mar 22, 2005 at 04:01:45PM +0000, Jamie L. Penman-Smithson wrote:
> > > logcheck-database contain postgrey ignore file, but postgrey first
> > > attempt is listed in logcheck report
> > Can you provide the log messages that are not caught please?
> 
> Mar 22 16:43:10 vortex postfix/smtpd[19674]: NOQUEUE: reject: RCPT from
<snip>
> I see in logcheck rules NOQUEUE should be ignored...

I've added the following rule to CVS which I've tested against the log
messages you gave me:

^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd\[[0-9]+\]:
[[:upper:]0-9]+: reject: RCPT from [^[:space:]]+: [45][0-9][0-9]
<[^[:space:]]+>: Client host rejected: Greylisted for 300 seconds \(see
http://isg.ee.ethz.ch/tools/postgrey/help/sythos.net.html\);
from=<[^[:space:]]*> to=<[^[:space:]]+> proto=(ESMTP|SMTP)
helo=<[^[:space:]]+>$

If in a future version of postgrey the message changes, this rule will
need to be updated. However, this means it can be tailored more - always
good for precious system resources.

Thanks for your bug report,

-- 
-jamie <jamie at silverdream.org> | spamtrap: spam at silverdream.org
 w: http://www.silverdream.org | p: sms at silverdream.org
 pgp key @ http://silverdream.org/~jps/pub.key
 21:30:02 up 17 min,  2 users,  load average: 2.65, 2.52, 1.58

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url : http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20050407/90f75e90/attachment.pgp