Bug#384265: cyrus-common-2.2: other logcheck warnings--still need tweaking

[Ross Boylan]

As luck would have it, just after the bug was closed I found the
patterns are not quite right, because this slipped through:
Sep 15 04:02:28 iron cyrus/lmtpunix[7988]: Delivered:
d988d7dba35bf4952c0732817324cbb3 to mailbox: user.ross.subversion
Sep 15 04:02:28 iron cyrus/lmtpunix[7988]: sieve redirected:
d988d7dba35bf4952c0732817324cbb3 to: ross at rawbw.com

The pattern I was using (and the one in #382942) assumes the messages
will always have angle brackets around them.  I don't know if the
absence indicates a problem.  Assuming it does not, and further assuming
that message id's don't have embedded spaces, I'm going to try these
patterns (untested):
cyrus/lmtpunix\[[0-9]+\]: +Delivered: [^ ]+ to mailbox: .*
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ cyrus/lmtpunix\[[0-9]+\]: sieve
redirected: [^ ]+ to: [._[:alnum:]-]+@[._[:alnum:]-]+$
So the message id is any sequence of non-space characters.

I'm currently running cyrus-imapd-2.2 (2.2.13-6).  This implies I do not
have the latest round of logcheck patterns; however, I believe I did
have them in my ignore.d.server/local file and they matched what was in
release -7.

On Thu, 2006-08-31 at 12:42 -0700, Ross Boylan wrote:
> On Fri, 2006-08-25 at 19:35 +0200, Sven Mueller wrote:
> > Ross Boylan wrote on 24/08/2006 20:58:
> > > While I'm at it, here are 2 more messages that probably should be
> > > screened out (each was originally a single line):
> > > 
> > > Aug 23 16:56:08 iron cyrus/imap[15676]: OTP unavailable because can't
> > > read/write key database /etc/opiekeys: No such file or directory
> > 
> > You could actually get rid of that one if you tell sasl not to use OTP
> > for cyrus-imapd (be it imap, pop3 or possibly even news). Just list an
> > explicit mech_list and don't list "otp" in there.
> Thanks.  I thought there should be a way.
> > 
> > I other words: I don't think we should mask that message.
> Agreed.
> > 
> > > Aug 23 16:57:32 iron cyrus/imap[15676]: Expunged 2 messages from
> > > user.ross
> > 
> > this one probably should get masked. However I currently don't have the
> > time to work out a regexp matching the full line. And especially not the
> > time to work out full-line-matching regexps for all the other ignore
> > clauses.
> Here's the pattern I used; it seems to work (one line in original):
> ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ cyrus/imap\[[0-9]+\]: Expunged [0-9]+
> messages? from [.[:alnum:]]+$
> 
> I'm not sure if those are exactly the right patterns for the general
> case.  I don't know if it ever says "message" (singular).
> 
> Ross
> 
-- 
Ross Boylan                                      wk:  (415) 514-8146
185 Berry St #5700                               ross at biostat.ucsf.edu
Dept of Epidemiology and Biostatistics           fax: (415) 514-8150
University of California, San Francisco
San Francisco, CA 94107-1739                     hm:  (415) 550-1062