Bug#325801: [Logcheck-devel] Bug#325801: logcheck: new regex to filter imap "Moved xxx bytes of new mail" messages

[maximilian attems]

tags 325801 pending
thanks

On Tue, 30 Aug 2005, toby cabot wrote:

> Hi folks, thanks for your work maintaining logcheck, it works well.
> 
> When my users read their mail using imap (usually via squirrelmail,
> not sure about other clients) I get a message like this in the log:
> 
> Aug 22 21:03:32 phoenix imapd[6551]: Moved 11323 bytes of new mail to /home/winky/mail/mbox from /var/spool/mail/winky host= localhost [127.0.0.1]
> 
> It seems to me that this is a normal enough system event that it can
> be filtered so I added a new regex to /etc/logcheck/ignore.d.server/imap:
> 
> imapd\[[._[:alnum:]-]+\]: Moved [0-9]+ bytes of new mail to [^[:space:]]+ from [^[:space:]]+ host= localhost \[127.0.0.1\]$
> 
> Thanks,
> Toby

indeed seems like pretty normal imap usage. ;)
thanks a lot for your helpfull bug report,
rule added to current logcheck cvs.

--
maks