On Wed, Aug 31, 2011 at 04:48:05PM +0200, Uwe Storbeck wrote: > For me these log messages contain a space at the end of the line > (snmpd version 5.4.3~dfsg-2). So this rule may need an additional > " ?" or " *" at the end to work for all cases: > > ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ snmpd\[[0-9]+\]: Connection from UDP: > \[[.0-9]{7,15}\]:[0-9]{4,5}->\[[.0-9]{7,15}\] ?$
I couldn't reproduce your issue. Does logcheck really report those log lines? Actually logcheck removes all trailing whitespaces before applying the rules. Greetings Hannes _______________________________________________ Logcheck-devel mailing list Logcheck-devel@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/logcheck-devel