> rule to CVS which matches the log message you gave:
>
> ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ courierpop3login: (TIMEOUT|
> DISCONNECTED), [EMAIL PROTECTED]:alnum:]]+, ip=\[[.:[:alnum:]]+\],
> top=[[:digit:]]+, retr=[[:digit:]]+, time=[[:digit:]]+$
>
> Thanks for your report,
i figuered out the reason why you have not found the rule i mentioned. the rule i mentioned is from a file named 'courier-pop' and this file gets installed with the 'courier-pop' package (didn't know that)!
FILE PACKAGE
etc/init.d/courier-pop mail/courier-pop
etc/logcheck/ignore.d.server/courier-pop mail/courier-pop
etc/logcheck/violations.ignore.d/courier-pop mail/courier-pop
i am not that sophiticated with logcheck philosophy. but i think alle rule files for logcheck should be centralized under the control of the logcheck team. does every application provide it's own rule files?
that strange and confusing. should i open a bug against 'courier-pop' for the wrong pattern? do i have to check every rule file if it's under the control of the logcheck team or if it's a rule file provided by another package?
signature.asc
Description: This is a digitally signed message part
