The following rules should be replaced
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+
postfix/policyd-weight\[[[:digit:]]+\]: (weighted check|decided action=PREPEND
X-policyd-weight): ([_[:alpha:]]+=((-)?[[:digit:].]+|ERR) ?)+(\(check from:
[^[:space:]]+ - helo: [^[:space:]]+ - helo-domain: [^[:space:]]+\)
([\()/_[:alnum:]]+=(-)?[[:digit:].]+ ?)+)?(; rate: (-)?[[:digit:].]+)?;
*<client=[^[:space:]]+> <helo=[^[:space:]]+> <from=[^[:space:]]+>
<to=[^[:space:]]+>(; rate: (-)?[[:digit:].]+)?(; delay: [[:digit:]]+s)? ?$
with this new rule:
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+
postfix/policyd-weight\[[[:digit:]]+\]: (weighted check|decided action=PREPEND
X-policyd-weight): ([_[:alpha:][:digit:]]+=((-)?[[:digit:].]+|ERR) ?)+(\(check
from: [^[:space:]]+ - helo: [^[:space:]]+ - helo-domain: [^[:space:]]+\)
([\()/_[:alnum:]]+=(-)?[[:digit:].]+ ?)+)?(; rate: (-)?[[:digit:].]+)?;
*<client=[^[:space:]]+> <helo=[^[:space:]]+> <from=[^[:space:]]+>
<to=[^[:space:]]+>(; rate: (-)?[[:digit:].]+)?(; delay: [[:digit:]]+s)? ?$
There is an additional [:digit:] to cover checks having digits.
For example: weighted check: NOT_IN_SBL_XBL_SPAMHAUS=-1.5 NOT_IN_SPAMCOP=-1.5
HELO_IP_IN_CL16_SUBNET=-0.41
HELO_IP_IN_CL16_SUBNET cannot be matched with the rule from the package.
_______________________________________________
Logcheck-devel mailing list
Logcheck-devel@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/logcheck-devel
