Your message dated Sat, 4 Oct 2025 07:08:02 +0200
with message-id <[email protected]>
and subject line Re: Bug#1116686: logcheck: grep complains about "?" at start
of RegEx on every run of logcheck
has caused the Debian Bug report #1116686,
regarding logcheck: grep complains about "?" at start of RegEx on every run of
logcheck
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1116686: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1116686
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: logcheck
Version: 1.4.5
Severity: normal
Dear Maintainer,
after upgrading to Bookworm (Debian 12) on every run of logcheck (from crontab)
I receive an additional e-mail from cron where grep complains about RegEx
starting with "?".
Subject:
Cron <logcheck@dom3> if [ ! -d /run/systemd/system ] && [ -x /usr/sbin/logcheck
]; then nice -n10 /usr/sbin/logcheck; fi
Body of the e-mail:
grep: warning: ? at start of expression
grep: warning: ? at start of expression
grep: warning: ? at start of expression
grep: warning: ? at start of expression
grep: warning: ? at start of expression
grep: warning: ? at start of expression
grep: warning: ? at start of expression
grep: warning: ? at start of expression
This happens with the logcheck package from Trixie (Debian 13), too.
The behaviour is apparently related to the fact that grep now (i.e. since
Bookworm) reacts more sensitively to the situation described (“? ” at the
beginning of the RegEx), as stated in the release notes and announced by
apt-listchanges.
But why does this happen with logcheck? I can't find any RegEx that starts with
a question mark:
# grep -r ^? /etc/logcheck/
#
Any ideas?
Thanks & kind Regards,
Paul
-- System Information:
Debian Release: 12.12
APT prefers oldstable-updates
APT policy: (500, 'oldstable-updates'), (500, 'oldstable-security'), (500,
'oldstable')
Architecture: amd64 (x86_64)
Kernel: Linux 6.1.0-40-amd64 (SMP w/2 CPU threads; PREEMPT)
Kernel taint flags: TAINT_WARN
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: sysvinit (via /sbin/init)
Versions of packages logcheck depends on:
ii adduser 3.134
ii cron [cron-daemon] 3.0pl1-162
ii exim4-daemon-light [mail-transport-agent] 4.96-15+deb12u7
ii lockfile-progs 0.1.19
ii logtail 1.4.5
ii mime-construct 1.12+really1.11-1
Versions of packages logcheck recommends:
ii logcheck-database 1.4.5
Versions of packages logcheck suggests:
ii rsyslog [system-log-daemon] 8.2302.0-1+deb12u1
-- Configuration Files:
/etc/logcheck/logcheck.logfiles.d/journal.logfiles changed [not included]
-- no debconf information
--- End Message ---
--- Begin Message ---
On 30.09.25 13:41, Richard Lewis wrote:
On Tue, 30 Sep 2025, 08:29 Paul Muster, <[email protected]> wrote:
I can't find any RegEx that starts with a question mark:
# grep -r ^? /etc/logcheck/
#
Any ideas?
i dont know, but i could believe "start of expression" (which is from grep)
may include start of a group or character classes rather thsn only the
start of a line.
Indeed. Thanks for this hint.
if you run logcheck on its own with the -d option (from commandline -- you
will need to use su/sudo: if you run "logcheck -d" it will), you will get
lots of info about what it is doing, that should help you find the files
being processed and that should help you narrow it down.
Both advices together lead me to a rules file containing "local" with
the problematic RegEx. After commenting out those the additional e-mail
is omitted.
Thank you for the quick reply and the helpful advice, Richard!
Regards,
Paul
--- End Message ---
