Hi,
I just solved this, because my servers have received disconnect messages
too.
rt:/etc/logcheck/ignore.d.server# cat postfix-local
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ postfix/smtpd\[[[:digit:]]+\]:
(dis)?connect from
It is simple modification of an original rule of postfix rules file.
rt:/etc/logcheck/ignore.d.server# fgrep 'connect from' postfix*
postfix:^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+
postfix/smtpd\[[[:digit:]]+\]: (dis)?connect from [^[:space:]]+$
postfix-local:^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+
postfix/smtpd\[[[:digit:]]+\]: (dis)?connect from
Simple removing
[^[:space:]]+$
from the end of the original rule solves the problem with spaces.
Maybe logcheck practise is to match the whole line every time, then
.*$
can be appropriate. But I thing it is needless.
--
Zito
