<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/3.2.4">
</HEAD>
<BODY>
the rule you mentioned is in ignore.d.server/pure-ftpd (see next line):<BR>
<BR>
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pure-ftpd: \([._[:alnum:]-]+@[._[:alnum:]-]+\) \[NOTICE\] .+ (up|down)loaded \([0-9]+ bytes, [0-9]+.[0-9]+KB/sec\)$<BR>
<BR>
yes those messages showing up as 'Security Events'. permissions are ok as far as i can say:<BR>
<BR>
-rw-r----- 1 root logcheck 1285 Feb 20 09:59 pure-ftpd<BR>
<BR>
i will give you the original line from syslog. maybe i stripped something important off:<BR>
<BR>
<TT>Feb 18 23:05:58 web1 pure-ftpd: (<A HREF="mailto:www-0004-01@80.140.246.12">www-0004-01@80.140.246.12</A>) [NOTICE] /docroot/nfs-action.com//htdocs/guradia/plugin/net.php.smarty/libs/plugins/modifier.debug_print_var.php uploaded (1863 bytes, 9.41KB/sec)</TT><BR>
<BR>
can't figuere out why the lines are not ignored.<BR>
<BR>
thanks in advice!<BR>
<BR>
<BR>
<BR>
On Sun, 2005-02-20 at 16:55 +0000, Jamie L. Penman-Smithson wrote:
<BLOCKQUOTE TYPE=CITE>
<PRE>
<FONT COLOR="#000000">On Sun, 2005-02-20 at 12:10 +0100, Ingo Theiss wrote:</FONT>
<FONT COLOR="#000000">> the pattern in ignore.d.server pure-ftpd for '[NOTICE] ... uploaded' is</FONT>
<FONT COLOR="#000000">> not matching the following message:</FONT>
<FONT COLOR="#000000">> </FONT>
<FONT COLOR="#000000">> Feb 18 23:06:18 example pure-ftpd: (<A HREF="mailto:test-9999-99@111.111.111.111">test-9999-99@111.111.111.111</A>) [NOTICE]</FONT>
<FONT COLOR="#000000">> /docroot/example.com//htdocs/guradia/plugin/net.php.smarty/libs/plugins/function.assign_debug_info.php</FONT>
<FONT COLOR="#000000">> uploaded (1116 bytes, 7.47KB/sec)</FONT>
<FONT COLOR="#000000">> </FONT>
<FONT COLOR="#000000">> maybe the double '//' is the problem.</FONT>
<FONT COLOR="#000000">The following rule matches those messages:</FONT>
<FONT COLOR="#000000">^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pure-ftpd:</FONT>
<FONT COLOR="#000000">\([._[:alnum:]-]+@[._[:alnum:]-]+\) \[NOTICE\] .+ (up|down)loaded</FONT>
<FONT COLOR="#000000">\([0-9]+ bytes, [0-9]+.[0-9]+KB/sec\)$</FONT>
<FONT COLOR="#000000">It's been in logcheck since 1.2.29, since you're using 1.2.34 you</FONT>
<FONT COLOR="#000000">shouldn't be seeing those messages..</FONT>
<FONT COLOR="#000000">Make sure you've got that rule in your ignore.d.server/pure-ftpd. Are</FONT>
<FONT COLOR="#000000">those messages showing up as Security Events? Are the permissions </FONT>i
<FONT COLOR="#000000">ignore.d.server/pure-ftpd okay?</FONT>
</PRE>
</BLOCKQUOTE>
</BODY>
</HTML>