[Logcheck-devel] Bug#398257: logcheck-database: lots of "session opened" and "session closed" information

[Juergen Richtsfeld]

Package: logcheck-database
Version: 1.2.49
Severity: normal


My logcheck configuration is quite a default one, ignore level server. i found the "session opened" and "session closed" ignore 
lines in ignore.d.server/logcheck. but i still get those lines in the logcheck mails:

Nov 12 17:17:01 server06 CRON[32741]: (pam_unix) session opened for user root by (uid=0)
Nov 12 17:17:01 server06 CRON[32741]: (pam_unix) session closed for user root

i get them too for other users, not only root. I took a look at the regexes in the logcheck ignore file, but i didn't see the problem. I've another system 
too also running debian etch which doesn't seem to have this problem. the only difference the two systems that have is that the problematc 
machine has syslog-ng (this is the only logging specific difference i'm aware of).


juergen


-- System Information:
Debian Release: 4.0
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: i386 (i686)
Shell:  /bin/sh linked to /bin/bash
Kernel: Linux 2.6.17-2-k7
Locale: LANG=en_US, LC_CTYPE=en_US (charmap=ISO-8859-1) (ignored: LC_ALL set to en_US)

Versions of packages logcheck-database depends on:
ii  debconf [debconf-2.0]         1.5.8      Debian configuration management sy

logcheck-database recommends no packages.

-- debconf information:
  logcheck-database/conffile-cleanup: false