Your message dated Fri, 14 May 2010 23:04:11 -0600
with message-id <[email protected]>
and subject line Re: [Logcheck-devel] Bug#581658: logcheck: ignore ssh
disconnect
has caused the Debian Bug report #581658,
regarding logcheck: ignore ssh disconnect
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
581658: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=581658
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: logcheck
Version: 1.3.8
Severity: normal
The new ssh in Squeeze now causes an additional line to be written by
sshd to the auth.log file:
May 14 12:13:33 localhost sshd[6940]: Received disconnect from 192.0.32.10:
11: disconnected by user
I suggest the following addition to the ignore.d.server/ssh rules.
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: Received disconnect from
[^[:space:]]+: [0-9]+: disconnected by user
Thanks,
Bob
--- End Message ---
--- Begin Message ---
Hannes von Haugwitz wrote:
> this should have been fixed in 1.3.7 (see #567317 or #567355).
>
> Please ensure that your version of /etc/logcheck/ignore.d.server/ssh is
> up to date and that you use the "server" or "workstation" level (set
> REPORTLEVEL in /etc/logcheck/logcheck.conf).
>
> Please provide feedback, if that solves your problem.
You are correct and I was confused. Due to some breakage in Sid
making some unrelated packages uninstallable I used snapshot to
install previous versions from when they were previously in an
installable state. And along with that I inadvertantly pulled in an
older version of logcheck. I had thought that I had an up to date
version but I had not. And I was also experiencing the same issue on
Stable Lenny machines and installing a local patch on those. The
combination defeated me.
I am closing the bug. Not a bug. Sorry for the noise!
Bob
--- End Message ---
_______________________________________________
Logcheck-devel mailing list
[email protected]
http://lists.alioth.debian.org/mailman/listinfo/logcheck-devel
