Sergi,<br><br>I'd try ignore.d.server, for some reason most of my rules end up there.<br><br>HtH,<br><br>Denis<br><br><div class="gmail_quote">On Thu, May 1, 2008 at 12:30 PM, Sergi Baila <<a href="mailto:sargue@gmail.com">sargue@gmail.com</a>> wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">Ok, this is the typical message to the list I suppose. But I've really<br>
tried all I can think of and probably need some more pair of eyes to<br>
find the glitch.<br>
<br>
I have this "Security event"<br>
<br>
May 1 20:08:57 ns1 kernel: martian source <a href="http://192.168.1.3" target="_blank">192.168.1.3</a> from<br>
<a href="http://192.168.1.3" target="_blank">192.168.1.3</a>, on dev eth0<br>
<br>
Which I want to filter out. As it's a 'security' one I put it on<br>
violations.ignore.d/local<br>
<br>
This is the current rule:<br>
<br>
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: martian source [0-9.]+ from<br>
[.0-9]+, on dev eth.$<br>
<br>
Which works using<br>
<br>
sed -e 's/[[:space:]]*$//' syslog | egrep '^\w{3} [ :0-9]{11}<br>
[._[:alnum:]-]+ kernel: martian source [0-9.]+ from [.0-9]+, on dev<br>
eth.$'<br>
<br>
But logcheck keeps me sending those!<br>
<br>
Any idea?<br>
<font color="#888888"><br>
--<br>
<a href="http://www.sargue.net" target="_blank">www.sargue.net</a><br>
<br>
_______________________________________________<br>
Logcheck-users mailing list<br>
<a href="mailto:Logcheck-users@lists.alioth.debian.org">Logcheck-users@lists.alioth.debian.org</a><br>
<a href="http://lists.alioth.debian.org/mailman/listinfo/logcheck-users" target="_blank">http://lists.alioth.debian.org/mailman/listinfo/logcheck-users</a><br>
</font></blockquote></div><br>