greg norris

Every now and then, logcheck complains about syslog messages such as
the one below. Not a big problem, but it's supposed to filter out
messages which match the associated regexp... which really should cover
this case, as far as I can see. Any idea why this one was missed?

---SNIP---
Dec 19 07:17:46 sasami spamd[23665]: processing message <200312191358.09611.meurer@bad-gmbh.de> for adric:1000.
---SNIP---

---SNIP---
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ spamd\[[0-9]+\]: processing message <.+> for \w+:[0-9]+\. $
---SNIP---

There really is a single space at the end of the line, btw, so it's
not that.


--
To UNSUBSCRIBE, email to debian-user-request@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

bill marcum

You don't say whether the message is listed as an "event" or a "security
violation", but I'm guessing it's the latter, and the reason is that
the email address contains "bad". If I'm right, the solution is to
create a file in violations.ignore.d containing an appropriate regexp,
perhaps "@bad-"


--
No animal should ever jump on the dining room furniture unless
absolutely certain he can hold his own in conversation.
-- Fran Lebowitz


--
To UNSUBSCRIBE, email to debian-user-request@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

greg norris

Yes, it's listed under "Possible Security Violations". Thanx for the
insight!


--
To UNSUBSCRIBE, email to debian-user-request@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

mark schouten

Well, it *is* the space at the end of the line. Why all the fuzz. Just
place an '?' behind the space.

Mark


--
To UNSUBSCRIBE, email to debian-user-request@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

greg norris

No it isn't. So far, all of the messages which have slipped through
have exactly one trailing space... exactly matching the regexp.


--
To UNSUBSCRIBE, email to debian-user-request@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org