On Wednesday 28 June 2006 09:17, Steve Holdoway wrote:
> 'cos it doesn't work!
>
> And I really don't understand why.
>
> Grrr.
>
> On Wed, 28 Jun 2006 08:30:35 +1200
>
> Carl Cerecke <[EMAIL PROTECTED]> wrote:
> > Why not just:
> >
> > .*did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA$
> >
> > Cheers,
> > Carl.
> >
> > On 28/06/06, Steve Holdoway <[EMAIL PROTECTED]> wrote:
> > > To preserve what's left of my sanity, can anyone help me with this
> > > logcheck rule? To ignore messages like this,
> > >
> > > Jun 28 06:02:18 server sm-mta[7813]: k5RI2I6g007813:
> > > 23-52-175-62.user.auna.net [62.175.52.23] (may be forged) did not issue
> > > MAIL/EXPN/VRFY/ETRN during connection to MTA
> > >
> > > I added the following line to /etc/logcheck/ignore.d.server/sendmail:
> > >
> > > ^\w{3} [ :0-9]{11} [._[:alnum:]-]+
> > > (sendmail|sm-(mta|msp|que))\[[0-9]+\]: [[:alnum:]]+:.*did not issue
> > > MAIL/EXPN/VRFY/ETRN during connection to MTA$
> > >
> > > ...and a couple of hours of variations on the theme. Can anyone point
> > > out the glaring error???
Check that there isn't a spurious space at the end of the line in the file or
something like that, it's happened to me before.
Also, there is a line that I can't get logcheck to ignore no matter what I do.
The pattern I use matches in syslog if you egrep it but not via logcheck. It
makes no sense and it still annoys me to this day. Maybe your case is
something similar.
Jun 27 14:43:11 bandit smartd[6389]: Device: /dev/hdb, SMART Prefailure
Attribute: 1 Raw_Read_Error_Rate changed from 50 to 47
Is my line that I am slowly learning to live with.
hads
--
Too much of a good thing is WONDERFUL.
-- Mae West
