[Logcheck-users] Re: rule seems to be matching all but last occurrence [SOLVED]

[Ross Boylan]

On Mon, Nov 06, 2006 at 01:29:13PM -0800, Ross Boylan wrote:
> Every hour I get a mail from logcheck with a line like
> Nov  6 12:08:34 wheat fetchnews[13617]: clamping maxage for comp.os.linux.admin to global expire 50

This was matching the "admin" pattern in violations.d/logcheck.  That is
why similar lines didn't show up (they didn't have admin in the group
name) and why my fiddles in ignore.d.server had no effect (this was a
"Security Event" not a "System Event").

I've developed some rules that I think fix it (and some other things)
up, but will test them for awhile.  When they look good, I'll submit a
bug, unless you'd prefer I just mail them to this list.

Ross Boylan