[Logcheck-devel] Bug#890894: logcheck-database: Updates for ignore.d.server/ssh for a stretch system

[Jose M Calhariz]

Package: logcheck-database
Version: 1.3.18
Severity: normal

Hi,

I am reviewing the ignore rules for ssh on my machines and found some
updates are needed.  This is my first approach for in the end generate
a proper patch to update the file ignore.d.server/ssh.

My proposed updates, not a proper patch:

#Updates for old messages
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Connection reset by [:.[:xdigit:]]+ port [[:digit:]]+ \[preauth\]$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Did not receive identification string from ([:[:xdigit:].]+|UNKNOWN)+ port [[:digit:]]+$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Disconnected from [:[:xdigit:].]+ port [[:digit:]]+ \[preauth\]$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: I(llegal|nvalid) user [^[:space:]]* from ([:.[:xdigit:]]+|UNKNOWN) port [[:digit:]]+$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Received disconnect from [:.[:xdigit:]]+(: | port [[:digit:]]+:)11:  \[preauth\]$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Received disconnect from [:.[:xdigit:]]+(: | port [[:digit:]]+:)11: (disconnected by user|Closed due to user request\.) \[preauth\]$

#New messages
#Feb 20 03:32:33 gw1 sshd[7271]: Received disconnect from 60.248.248.148 port 57727:11: Bye Bye [preauth]
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+:11: Bye Bye \[preauth\]$

#Feb 19 22:31:10 gw1 sshd[30597]: Unable to negotiate with 195.154.102.221 port 61875: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth]
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Unable to negotiate with [:.[:xdigit:]]+ port [[:digit:]]+: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 \[preauth\]$

#Feb 19 17:16:14 gw1 sshd[21179]: Unable to negotiate with 134.213.156.122 port 45349: no matching cipher found. Their offer: none [preauth]
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Unable to negotiate with [:.[:xdigit:]]+ port [[:digit:]]+: no matching cipher found. Their offer: none \[preauth\]$

#Feb 19 17:05:36 gw1 sshd[21017]: Received disconnect from 84.200.93.71 port 45442:11: Normal Shutdown, Thank you for playing [preauth]
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+:11: Normal Shutdown, Thank you for playing \[preauth\]$


-- System Information:
Debian Release: 9.3
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'oldstable-updates'), (500, 'stable'), (500, 'oldstable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.9.0-4-amd64 (SMP w/4 CPU cores)
Locale: LANG=C, LC_CTYPE=C (charmap=UTF-8) (ignored: LC_ALL set to en_GB.UTF-8), LANGUAGE=C (charmap=UTF-8) (ignored: LC_ALL set to en_GB.UTF-8)
Shell: /bin/sh linked to /bin/bash
Init: systemd (via /run/systemd/system)

-- Configuration Files:
/etc/logcheck/cracking.d/kernel [Errno 13] Permission denied: '/etc/logcheck/cracking.d/kernel'
/etc/logcheck/cracking.d/rlogind [Errno 13] Permission denied: '/etc/logcheck/cracking.d/rlogind'
/etc/logcheck/cracking.d/rsh [Errno 13] Permission denied: '/etc/logcheck/cracking.d/rsh'
/etc/logcheck/cracking.d/smartd [Errno 13] Permission denied: '/etc/logcheck/cracking.d/smartd'
/etc/logcheck/cracking.d/tftpd [Errno 13] Permission denied: '/etc/logcheck/cracking.d/tftpd'
/etc/logcheck/cracking.d/uucico [Errno 13] Permission denied: '/etc/logcheck/cracking.d/uucico'
/etc/logcheck/ignore.d.paranoid/bind [Errno 13] Permission denied: '/etc/logcheck/ignore.d.paranoid/bind'
/etc/logcheck/ignore.d.paranoid/cron [Errno 13] Permission denied: '/etc/logcheck/ignore.d.paranoid/cron'
/etc/logcheck/ignore.d.paranoid/incron [Errno 13] Permission denied: '/etc/logcheck/ignore.d.paranoid/incron'
/etc/logcheck/ignore.d.paranoid/logcheck [Errno 13] Permission denied: '/etc/logcheck/ignore.d.paranoid/logcheck'
/etc/logcheck/ignore.d.paranoid/postfix [Errno 13] Permission denied: '/etc/logcheck/ignore.d.paranoid/postfix'
/etc/logcheck/ignore.d.paranoid/ppp [Errno 13] Permission denied: '/etc/logcheck/ignore.d.paranoid/ppp'
/etc/logcheck/ignore.d.paranoid/pureftp [Errno 13] Permission denied: '/etc/logcheck/ignore.d.paranoid/pureftp'
/etc/logcheck/ignore.d.paranoid/qpopper [Errno 13] Permission denied: '/etc/logcheck/ignore.d.paranoid/qpopper'
/etc/logcheck/ignore.d.paranoid/squid [Errno 13] Permission denied: '/etc/logcheck/ignore.d.paranoid/squid'
/etc/logcheck/ignore.d.paranoid/ssh [Errno 13] Permission denied: '/etc/logcheck/ignore.d.paranoid/ssh'
/etc/logcheck/ignore.d.paranoid/stunnel [Errno 13] Permission denied: '/etc/logcheck/ignore.d.paranoid/stunnel'
/etc/logcheck/ignore.d.paranoid/sysklogd [Errno 13] Permission denied: '/etc/logcheck/ignore.d.paranoid/sysklogd'
/etc/logcheck/ignore.d.paranoid/telnetd [Errno 13] Permission denied: '/etc/logcheck/ignore.d.paranoid/telnetd'
/etc/logcheck/ignore.d.paranoid/tripwire [Errno 13] Permission denied: '/etc/logcheck/ignore.d.paranoid/tripwire'
/etc/logcheck/ignore.d.paranoid/usb [Errno 13] Permission denied: '/etc/logcheck/ignore.d.paranoid/usb'
/etc/logcheck/ignore.d.server/acpid [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/acpid'
/etc/logcheck/ignore.d.server/amandad [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/amandad'
/etc/logcheck/ignore.d.server/amavisd-new [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/amavisd-new'
/etc/logcheck/ignore.d.server/anacron [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/anacron'
/etc/logcheck/ignore.d.server/anon-proxy [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/anon-proxy'
/etc/logcheck/ignore.d.server/apache [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/apache'
/etc/logcheck/ignore.d.server/apcupsd [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/apcupsd'
/etc/logcheck/ignore.d.server/arpwatch [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/arpwatch'
/etc/logcheck/ignore.d.server/asterisk [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/asterisk'
/etc/logcheck/ignore.d.server/automount [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/automount'
/etc/logcheck/ignore.d.server/bind [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/bind'
/etc/logcheck/ignore.d.server/bluez-utils [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/bluez-utils'
/etc/logcheck/ignore.d.server/courier [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/courier'
/etc/logcheck/ignore.d.server/cpqarrayd [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/cpqarrayd'
/etc/logcheck/ignore.d.server/cpufreqd [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/cpufreqd'
/etc/logcheck/ignore.d.server/cron [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/cron'
/etc/logcheck/ignore.d.server/cron-apt [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/cron-apt'
/etc/logcheck/ignore.d.server/cups-lpd [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/cups-lpd'
/etc/logcheck/ignore.d.server/cvs-pserver [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/cvs-pserver'
/etc/logcheck/ignore.d.server/cvsd [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/cvsd'
/etc/logcheck/ignore.d.server/cyrus [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/cyrus'
/etc/logcheck/ignore.d.server/dcc [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/dcc'
/etc/logcheck/ignore.d.server/ddclient [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/ddclient'
/etc/logcheck/ignore.d.server/dhclient [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/dhclient'
/etc/logcheck/ignore.d.server/dhcp [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/dhcp'
/etc/logcheck/ignore.d.server/dictd [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/dictd'
/etc/logcheck/ignore.d.server/dkfilter [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/dkfilter'
/etc/logcheck/ignore.d.server/dnsmasq [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/dnsmasq'
/etc/logcheck/ignore.d.server/dovecot [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/dovecot'
/etc/logcheck/ignore.d.server/dropbear [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/dropbear'
/etc/logcheck/ignore.d.server/dspam [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/dspam'
/etc/logcheck/ignore.d.server/epmd [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/epmd'
/etc/logcheck/ignore.d.server/exim4 [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/exim4'
/etc/logcheck/ignore.d.server/fcron [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/fcron'
/etc/logcheck/ignore.d.server/ftpd [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/ftpd'
/etc/logcheck/ignore.d.server/git-daemon [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/git-daemon'
/etc/logcheck/ignore.d.server/gnu-imap4d [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/gnu-imap4d'
/etc/logcheck/ignore.d.server/gps [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/gps'
/etc/logcheck/ignore.d.server/grinch [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/grinch'
/etc/logcheck/ignore.d.server/horde3 [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/horde3'
/etc/logcheck/ignore.d.server/hplip [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/hplip'
/etc/logcheck/ignore.d.server/hylafax [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/hylafax'
/etc/logcheck/ignore.d.server/ikiwiki [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/ikiwiki'
/etc/logcheck/ignore.d.server/imap [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/imap'
/etc/logcheck/ignore.d.server/imapproxy [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/imapproxy'
/etc/logcheck/ignore.d.server/imp [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/imp'
/etc/logcheck/ignore.d.server/imp4 [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/imp4'
/etc/logcheck/ignore.d.server/innd [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/innd'
/etc/logcheck/ignore.d.server/ipppd [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/ipppd'
/etc/logcheck/ignore.d.server/isdnlog [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/isdnlog'
/etc/logcheck/ignore.d.server/isdnutils [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/isdnutils'
/etc/logcheck/ignore.d.server/jabberd [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/jabberd'
/etc/logcheck/ignore.d.server/kernel [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/kernel'
/etc/logcheck/ignore.d.server/klogind [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/klogind'
/etc/logcheck/ignore.d.server/krb5-kdc [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/krb5-kdc'
/etc/logcheck/ignore.d.server/libpam-krb5 [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/libpam-krb5'
/etc/logcheck/ignore.d.server/libpam-mount [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/libpam-mount'
/etc/logcheck/ignore.d.server/logcheck [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/logcheck'
/etc/logcheck/ignore.d.server/login [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/login'
/etc/logcheck/ignore.d.server/maradns [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/maradns'
/etc/logcheck/ignore.d.server/mldonkey-server [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/mldonkey-server'
/etc/logcheck/ignore.d.server/mon [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/mon'
/etc/logcheck/ignore.d.server/mountd [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/mountd'
/etc/logcheck/ignore.d.server/nagios [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/nagios'
/etc/logcheck/ignore.d.server/netconsole [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/netconsole'
/etc/logcheck/ignore.d.server/nfs [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/nfs'
/etc/logcheck/ignore.d.server/nntpcache [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/nntpcache'
/etc/logcheck/ignore.d.server/nscd [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/nscd'
/etc/logcheck/ignore.d.server/nslcd [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/nslcd'
/etc/logcheck/ignore.d.server/openvpn [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/openvpn'
/etc/logcheck/ignore.d.server/otrs [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/otrs'
/etc/logcheck/ignore.d.server/passwd [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/passwd'
/etc/logcheck/ignore.d.server/pdns [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/pdns'
/etc/logcheck/ignore.d.server/perdition [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/perdition'
/etc/logcheck/ignore.d.server/policyd [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/policyd'
/etc/logcheck/ignore.d.server/popa3d [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/popa3d'
/etc/logcheck/ignore.d.server/postfix [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/postfix'
/etc/logcheck/ignore.d.server/postfix-policyd [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/postfix-policyd'
/etc/logcheck/ignore.d.server/ppp [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/ppp'
/etc/logcheck/ignore.d.server/pptpd [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/pptpd'
/etc/logcheck/ignore.d.server/procmail [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/procmail'
/etc/logcheck/ignore.d.server/proftpd [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/proftpd'
/etc/logcheck/ignore.d.server/pure-ftpd [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/pure-ftpd'
/etc/logcheck/ignore.d.server/pureftp [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/pureftp'
/etc/logcheck/ignore.d.server/qpopper [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/qpopper'
/etc/logcheck/ignore.d.server/rbldnsd [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/rbldnsd'
/etc/logcheck/ignore.d.server/rpc_statd [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/rpc_statd'
/etc/logcheck/ignore.d.server/rsnapshot [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/rsnapshot'
/etc/logcheck/ignore.d.server/rsync [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/rsync'
/etc/logcheck/ignore.d.server/sa-exim [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/sa-exim'
/etc/logcheck/ignore.d.server/samba [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/samba'
/etc/logcheck/ignore.d.server/saned [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/saned'
/etc/logcheck/ignore.d.server/sasl2-bin [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/sasl2-bin'
/etc/logcheck/ignore.d.server/saslauthd [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/saslauthd'
/etc/logcheck/ignore.d.server/schroot [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/schroot'
/etc/logcheck/ignore.d.server/scponly [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/scponly'
/etc/logcheck/ignore.d.server/slapd [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/slapd'
/etc/logcheck/ignore.d.server/smartd [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/smartd'
/etc/logcheck/ignore.d.server/smbd_audit [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/smbd_audit'
/etc/logcheck/ignore.d.server/smokeping [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/smokeping'
/etc/logcheck/ignore.d.server/snmpd [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/snmpd'
/etc/logcheck/ignore.d.server/snort [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/snort'
/etc/logcheck/ignore.d.server/spamc [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/spamc'
/etc/logcheck/ignore.d.server/spamd [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/spamd'
/etc/logcheck/ignore.d.server/squid [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/squid'
/etc/logcheck/ignore.d.server/ssh [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/ssh'
/etc/logcheck/ignore.d.server/stunnel [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/stunnel'
/etc/logcheck/ignore.d.server/su [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/su'
/etc/logcheck/ignore.d.server/sudo [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/sudo'
/etc/logcheck/ignore.d.server/sympa [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/sympa'
/etc/logcheck/ignore.d.server/syslogd [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/syslogd'
/etc/logcheck/ignore.d.server/systemd [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/systemd'
/etc/logcheck/ignore.d.server/systemd-timesyncd [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/systemd-timesyncd'
/etc/logcheck/ignore.d.server/teapop [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/teapop'
/etc/logcheck/ignore.d.server/telnetd [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/telnetd'
/etc/logcheck/ignore.d.server/tftpd [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/tftpd'
/etc/logcheck/ignore.d.server/thy [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/thy'
/etc/logcheck/ignore.d.server/ucd-snmp [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/ucd-snmp'
/etc/logcheck/ignore.d.server/upsd [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/upsd'
/etc/logcheck/ignore.d.server/uptimed [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/uptimed'
/etc/logcheck/ignore.d.server/userv [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/userv'
/etc/logcheck/ignore.d.server/vsftpd [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/vsftpd'
/etc/logcheck/ignore.d.server/watchdog [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/watchdog'
/etc/logcheck/ignore.d.server/wu-ftpd [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/wu-ftpd'
/etc/logcheck/ignore.d.server/xinetd [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/xinetd'
/etc/logcheck/ignore.d.workstation/automount [Errno 13] Permission denied: '/etc/logcheck/ignore.d.workstation/automount'
/etc/logcheck/ignore.d.workstation/bind [Errno 13] Permission denied: '/etc/logcheck/ignore.d.workstation/bind'
/etc/logcheck/ignore.d.workstation/bluetooth-alsa [Errno 13] Permission denied: '/etc/logcheck/ignore.d.workstation/bluetooth-alsa'
/etc/logcheck/ignore.d.workstation/bluez-utils [Errno 13] Permission denied: '/etc/logcheck/ignore.d.workstation/bluez-utils'
/etc/logcheck/ignore.d.workstation/bonobo [Errno 13] Permission denied: '/etc/logcheck/ignore.d.workstation/bonobo'
/etc/logcheck/ignore.d.workstation/dhcpcd [Errno 13] Permission denied: '/etc/logcheck/ignore.d.workstation/dhcpcd'
/etc/logcheck/ignore.d.workstation/francine [Errno 13] Permission denied: '/etc/logcheck/ignore.d.workstation/francine'
/etc/logcheck/ignore.d.workstation/gconf [Errno 13] Permission denied: '/etc/logcheck/ignore.d.workstation/gconf'
/etc/logcheck/ignore.d.workstation/gdm [Errno 13] Permission denied: '/etc/logcheck/ignore.d.workstation/gdm'
/etc/logcheck/ignore.d.workstation/hald [Errno 13] Permission denied: '/etc/logcheck/ignore.d.workstation/hald'
/etc/logcheck/ignore.d.workstation/hcid [Errno 13] Permission denied: '/etc/logcheck/ignore.d.workstation/hcid'
/etc/logcheck/ignore.d.workstation/ifplugd [Errno 13] Permission denied: '/etc/logcheck/ignore.d.workstation/ifplugd'
/etc/logcheck/ignore.d.workstation/ippl [Errno 13] Permission denied: '/etc/logcheck/ignore.d.workstation/ippl'
/etc/logcheck/ignore.d.workstation/kdm [Errno 13] Permission denied: '/etc/logcheck/ignore.d.workstation/kdm'
/etc/logcheck/ignore.d.workstation/kernel [Errno 13] Permission denied: '/etc/logcheck/ignore.d.workstation/kernel'
/etc/logcheck/ignore.d.workstation/laptop-mode-tools [Errno 13] Permission denied: '/etc/logcheck/ignore.d.workstation/laptop-mode-tools'
/etc/logcheck/ignore.d.workstation/libmtp-runtime [Errno 13] Permission denied: '/etc/logcheck/ignore.d.workstation/libmtp-runtime'
/etc/logcheck/ignore.d.workstation/libpam-gnome-keyring [Errno 13] Permission denied: '/etc/logcheck/ignore.d.workstation/libpam-gnome-keyring'
/etc/logcheck/ignore.d.workstation/logcheck [Errno 13] Permission denied: '/etc/logcheck/ignore.d.workstation/logcheck'
/etc/logcheck/ignore.d.workstation/login [Errno 13] Permission denied: '/etc/logcheck/ignore.d.workstation/login'
/etc/logcheck/ignore.d.workstation/net-acct [Errno 13] Permission denied: '/etc/logcheck/ignore.d.workstation/net-acct'
/etc/logcheck/ignore.d.workstation/nntpcache [Errno 13] Permission denied: '/etc/logcheck/ignore.d.workstation/nntpcache'
/etc/logcheck/ignore.d.workstation/polypaudio [Errno 13] Permission denied: '/etc/logcheck/ignore.d.workstation/polypaudio'
/etc/logcheck/ignore.d.workstation/postfix [Errno 13] Permission denied: '/etc/logcheck/ignore.d.workstation/postfix'
/etc/logcheck/ignore.d.workstation/ppp [Errno 13] Permission denied: '/etc/logcheck/ignore.d.workstation/ppp'
/etc/logcheck/ignore.d.workstation/proftpd [Errno 13] Permission denied: '/etc/logcheck/ignore.d.workstation/proftpd'
/etc/logcheck/ignore.d.workstation/pump [Errno 13] Permission denied: '/etc/logcheck/ignore.d.workstation/pump'
/etc/logcheck/ignore.d.workstation/sendfile [Errno 13] Permission denied: '/etc/logcheck/ignore.d.workstation/sendfile'
/etc/logcheck/ignore.d.workstation/slim [Errno 13] Permission denied: '/etc/logcheck/ignore.d.workstation/slim'
/etc/logcheck/ignore.d.workstation/squid [Errno 13] Permission denied: '/etc/logcheck/ignore.d.workstation/squid'
/etc/logcheck/ignore.d.workstation/udev [Errno 13] Permission denied: '/etc/logcheck/ignore.d.workstation/udev'
/etc/logcheck/ignore.d.workstation/wdm [Errno 13] Permission denied: '/etc/logcheck/ignore.d.workstation/wdm'
/etc/logcheck/ignore.d.workstation/winbind [Errno 13] Permission denied: '/etc/logcheck/ignore.d.workstation/winbind'
/etc/logcheck/ignore.d.workstation/wpasupplicant [Errno 13] Permission denied: '/etc/logcheck/ignore.d.workstation/wpasupplicant'
/etc/logcheck/ignore.d.workstation/xdm [Errno 13] Permission denied: '/etc/logcheck/ignore.d.workstation/xdm'
/etc/logcheck/ignore.d.workstation/xlockmore [Errno 13] Permission denied: '/etc/logcheck/ignore.d.workstation/xlockmore'
/etc/logcheck/violations.d/kernel [Errno 13] Permission denied: '/etc/logcheck/violations.d/kernel'
/etc/logcheck/violations.d/logcheck [Errno 13] Permission denied: '/etc/logcheck/violations.d/logcheck'
/etc/logcheck/violations.d/smartd [Errno 13] Permission denied: '/etc/logcheck/violations.d/smartd'
/etc/logcheck/violations.d/su [Errno 13] Permission denied: '/etc/logcheck/violations.d/su'
/etc/logcheck/violations.d/sudo [Errno 13] Permission denied: '/etc/logcheck/violations.d/sudo'
/etc/logcheck/violations.ignore.d/logcheck-su [Errno 13] Permission denied: '/etc/logcheck/violations.ignore.d/logcheck-su'
/etc/logcheck/violations.ignore.d/logcheck-sudo [Errno 13] Permission denied: '/etc/logcheck/violations.ignore.d/logcheck-sudo'

-- debconf information:
* logcheck-database/rules-directories-note:
* logcheck-database/security_level: paranoid
* logcheck-database/standard-rename-note:
* logcheck-database/conffile-cleanup: true