[Logcheck-users] problem with logcheck rules

[Ric Otte]

Hi,

I am running logcheck 1.2.28 on Debian testing but am unable to modify the
rules to prevent certain information being mailed to me.  I get loads of
messages like the following in the System Events section of the email:

Nov 24 01:08:01 phil cron(pam_unix)[4763]: session opened for user mail by (uid=0)
Nov 24 01:08:01 phil cron(pam_unix)[4763]: session closed for user mail
Nov 24 01:09:01 phil cron(pam_unix)[4768]: session opened for user root by (uid=0)
Nov 24 01:09:01 phil cron(pam_unix)[4768]: session closed for user root

After reading the information in /usr/share/doc/logcheck-database, I made a
file 'local' in /etc/logcheck/ignore.d.server that contains the following
lines:

 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ cron\(pam_unix\)\[[0-9]+\]: session
 closed for user root$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ cron\(pam_unix\)\[[0-9]+\]: session
 closed for user mail$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ cron\(pam_unix\)\[[0-9]+\]: session
 opened for user mail by \ (uid=[0-9]+\)$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ cron\(pam_unix\)\[[0-9]+\]: session
 opened for user root by \ (uid=[0-9]+\)$

But this had no effect at all.  I then placed this file in
/etc/logcheck/violations.ignore.d/local but it also had no effect there.  As
far as I can tell, my rules files in the /etc/logcheck directories are having
no effect at all.  These rules do find the relevant lines when I use them
manually with egrep.  My /etc/logcheck/logcheck.conf file contains the
following:

    REPORTLEVEL="server"                                                
    SENDMAILTO="ric"    
    RULEDIR="/etc/logcheck"
    ATTACKSUBJECT="Attack Alerts"
    SECURITYSUBJECT="Security Events"
    #EVENTSSUBJECT="System Events"
I am also puzzled that I still get a System Events subject line section, even
though this line is commented out in logcheck.conf.

Any suggestions would be appreciated; I've tried lots of different regexp in
the files, and nothing seems to work.  I'm wondering if there is some setting I
need to change in order to get logcheck to read the rule files.  Thanks,

Ric