Bug#308800: [Logcheck-devel] Bug#308800: logcheck-database: new rsync output doesn't match the existing ignore rules

[maximilian attems]

tags 308800 pending
thanks

On Thu, 12 May 2005, Paul Slootman wrote:

> Concerning the file /etc/logcheck/ignore.d.server/rsync :
> 
> The current rsync daemon (2.6.4) gives messages such as this:
> 
> May 12 04:13:01 hostname rsyncd[5675]: sent 1415 bytes  received 88 bytes  total size 2550200
> 
> The print format is now:
>     sent %.0f bytes  received %.0f bytes  total size %.0f
> This used to be (2.6.3 and earlier versions):
>     wrote %.0f bytes  read %.0f bytes  total size %.0f
> 
> I'd suggest replacing the current line:
> 
> ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ rsyncd\[[0-9]+\]: wrote [0-9]+ bytes  read [0-9]+ bytes  total size [0-9]+$
> 
> with:
> 
> ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ rsyncd\[[0-9]+\]: sent [0-9]+ bytes  received [0-9]+ bytes  total size [0-9]+$
> 
ok. :)
 
> Alternatively you could just add the new line...
well we still want to match also the old lines for logserver processing.
added this rule to the logcheck cvs:
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ rsyncd\[[0-9]+\]: (wrote|sent) [0-9]+ bytes  (read|received) [0-9]+ bytes  total size [0-9]+$
 
> Thanks,
> Paul Slootman (rsync maintainer :-)

thanks for your work!!!
best wishes + regards

--
maks