[Logcheck-devel] Bug#816685: postfix disconnect matching rule

[Václav Ovsík]

Hi,
I just solved this, because my servers have received disconnect messages
too.

  rt:/etc/logcheck/ignore.d.server# cat postfix-local
  ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ postfix/smtpd\[[[:digit:]]+\]: (dis)?connect from

It is simple modification of an original rule of postfix rules file.

  rt:/etc/logcheck/ignore.d.server# fgrep 'connect from' postfix*
  postfix:^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ postfix/smtpd\[[[:digit:]]+\]: (dis)?connect from [^[:space:]]+$
  postfix-local:^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ postfix/smtpd\[[[:digit:]]+\]: (dis)?connect from

Simple removing
    [^[:space:]]+$
from the end of the original rule solves the problem with spaces.
Maybe logcheck practise is to match the whole line every time, then
    .*$
can be appropriate. But I thing it is needless.
-- 
Zito