[Logcheck-devel] Bug#732298: logcheck-database: dhclient diag message changed; updated rule to ignore it

[Dave Rutherford]

Package: logcheck-database
Version: 1.3.15
Severity: normal
Tags: patch

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[Apologies if this is a dup; I submitted yesterday but got no conf.
and don't see it at the online tracker.]

Configured in server mode, logcheck does not ignore messages such
as these -
    Dec 15 06:40:14 bb dhclient: parse_option_buffer: malformed option
dhcp.smtp-server (code 69): option length exceeds option buffer length.
    Dec 15 10:35:39 bb dhclient: parse_option_buffer: malformed option
dhcp.<unknown> (code 111): option length exceeds option buffer length.

There is a rule in ignore.server.d/dhclient which apparently is
intended to catch similar messages. My guess is that dhclient has
updated its text and logcheck didn't follow. The result can be
notifications when nothing truly relevant has happened.

This patch ignores the new error text as well as leaving the old match.


*** dhclient.diff
*** /etc/logcheck/ignore.d.server/dhclient.orig	Sun Dec 15 13:53:55 2013
- --- /etc/logcheck/ignore.d.server/dhclient	Sun Dec 15 08:13:41 2013
***************
*** 24,26 ****
- --- 24,27 ----
  ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhclient(-2.2.x)?: Sleeping\.$
  # 3.0
  ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhclient: parse_option_buffer: option [-[:alnum:]]+ \([[:digit:]]+\) larger than buffer\.$
+ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhclient: parse_option_buffer: malformed option dhcp\.[-[:alnum:]<>]+ \(code [[:digit:]]+\): option length exceeds option buffer length\.$


- -- System Information:
Debian Release: 7.2
  APT prefers stable
  APT policy: (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 3.2.0-4-amd64 (SMP w/2 CPU cores)
Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968)
Shell: /bin/sh linked to /bin/dash

- -- Configuration Files:
/etc/logcheck/ignore.d.server/dhclient changed [not included]

- -- no debconf information

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlKu+48ACgkQnN+41NpzKveJPACggiY0mpyfZmVYcF22cNiBnBl9
CH4AnRaqw78hQMuY7lD73vwKtb4bjHWg
=pEX4
-----END PGP SIGNATURE-----