[Logcheck-devel] Bug#499393: logcheck-database: paranoid cron rules let session close messages through

[Ferenc Wagner]

Package: logcheck-database
Version: 1.2.54
Severity: normal

Hi,

/etc/logcheck/ignore.d.paranoid/cron contains the last line:

^\w{3} [ :0-9]{11} [._[:alnum:]-]+ CRON\[[0-9]+\]: pam_[[:alnum:]]+\(cron:session\): session opened for user [[:alnum:]-]+( by \(uid=[0-9]+\))?$

wouldn't it be better transformed into

^\w{3} [ :0-9]{11} [._[:alnum:]-]+ CRON\[[0-9]+\]: pam_[[:alnum:]]+\(cron:session\): session (opened|closed) for user [[:alnum:]-]+( by \(uid=[0-9]+\))?$

to suppress close messages, too?  I've got no experience with the
butlast line, but that also seems to miss a similar clause.

Thanks,
Feri.

-- System Information:
Debian Release: 4.0
  APT prefers stable
  APT policy: (600, 'stable'), (50, 'unstable')
Architecture: i386 (i686)
Shell:  /bin/sh linked to /bin/bash
Kernel: Linux 2.6.26-1-686
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)

Versions of packages logcheck-database depends on:
ii  debconf [debconf-2.0]        1.5.11etch2 Debian configuration management sy

logcheck-database recommends no packages.

-- debconf information excluded