[Logcheck-devel] Bug#308800: logcheck-database: new rsync output doesn't match the existing ignore rules

[Paul Slootman]

Package: logcheck-database
Severity: normal

Concerning the file /etc/logcheck/ignore.d.server/rsync :

The current rsync daemon (2.6.4) gives messages such as this:

May 12 04:13:01 hostname rsyncd[5675]: sent 1415 bytes  received 88 bytes  total size 2550200

The print format is now:
    sent %.0f bytes  received %.0f bytes  total size %.0f
This used to be (2.6.3 and earlier versions):
    wrote %.0f bytes  read %.0f bytes  total size %.0f

I'd suggest replacing the current line:

^\w{3} [ :0-9]{11} [._[:alnum:]-]+ rsyncd\[[0-9]+\]: wrote [0-9]+ bytes  read [0-9]+ bytes  total size [0-9]+$

with:

^\w{3} [ :0-9]{11} [._[:alnum:]-]+ rsyncd\[[0-9]+\]: sent [0-9]+ bytes  received [0-9]+ bytes  total size [0-9]+$


Alternatively you could just add the new line...


Thanks,
Paul Slootman (rsync maintainer :-)