<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
Hi!<br>
Thanks for the quick response. What should the permissions be?<br>
Lia<br>
<br>
Todd Troxell wrote:
<blockquote cite="mid20051122035822.GA6671@rapidpacket.com" type="cite">
<pre wrap="">Hi Lia,
On Mon, Nov 21, 2005 at 04:57:26PM -0500, Lia Treffman wrote:
</pre>
<blockquote type="cite">
<pre wrap="">I am using Linux smtp 2.6.8-2-686-smp and libc6 2.3.2.ds1-22.
I am running logcheck on a server named smtp, and I would like to filter
all lines in /var/log/syslog matching the following expressions:
Nov 21 19:29:13 smtp postfix/policy-spf[1429]: blah blah blah
Nov 21 19:23:01 smtp amavis[31328]: blah blah blah
I have a file called 'noise':
smtp postfix/policy-spf.*$
smtp amavis.*$
When I run 'grep -f noise /var/log/syslog', I get the expected result.
For convenience, I have attached 'noise' and 'sample_syslog', which is a
sterilized segment of our /var/log/syslog.
I have tried running logcheck with 'noise' in the following directories:
/etc/logcheck/ignore.d -> ignore.d.server
/etc/logcheck/violations.ignore.d
/etc/logcheck/cracking.ignore.d
I have also tried putting the text of 'noise' in the following files:
/etc/logcheck/ignore.d/postfix or amavis (as appropriate)
/etc/logcheck/violations.ignore.d/logcheck-postfix or logcheck-amavis
(as appropriate)
All of the postfix/policy-spf and amavis records appear in the email. I
have also tried it with the '^\w{3} [ :0-9]{11} [._[:alnum:]-]+' lead-in
to the regex and it doesn't make a difference.
There are other regexes in /etc/logcheck/ignore.d files which also do
not filter as they are supposed to. However, the postfix/policy-spf and
amavis are the most problematic.
</pre>
</blockquote>
<pre wrap=""><!---->
I was unable to reproduce this. I dropped your noise file into my
/etc/logcheck/ignore.d.server/ and ran it through your sample_syslog in both
1.2.39 and current CVS head to no avail.
Are you sure the permissions are correct on your rule files/dirs?
--
Todd Troxell
<a class="moz-txt-link-freetext" href="http://xtat.rapidpacket.com/">http://xtat.rapidpacket.com/</a>
</pre>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="100">--
Lia Treffman Optivel, Inc. 317-275-2304
Network Systems Developer / DBA Sorcerer's Apprentice <a class="moz-txt-link-abbreviated" href="mailto:ltreffman@optivel.com">ltreffman@optivel.com</a> <a class="moz-txt-link-freetext" href="http://www.optivel.com">http://www.optivel.com</a>
</pre>
</body>
</html>