package logcheck-database tags 327088 pending thanks On Wed, 2005-09-07 at 17:44 +0200, Marco Nenciarini wrote: > Your rule does not fit the case that the client have an ipv6 ip. Yhis > is the log: > > Sep 7 17:41:12 lorien pop3-login: Login: [EMAIL PROTECTED] > [2001:1418:13:10::1]
Adjusted for next release:
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ (imap|pop3)-login: Login:
[.[:alnum:[EMAIL PROTECTED] \[(::ffff:)?[:0-9.]+\]$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ (dovecot: )?(imap|pop3)-login:
Disconnected \[(::ffff:)?[:0-9.]+\]$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ (dovecot: )?(imap|
pop3)\([^[:space:]]+\): File isn't in mbox format: [^[:space:]]+$
# dovecot 1.0
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dovecot: (imap|pop3)-login: Login:
user=<[.[:alnum:[EMAIL PROTECTED]>, method=(PLAIN|LOGIN|(CRAM|DIGEST)-MD5),
rip=(::ffff:)?[:.[:digit:]]+, lip=(::ffff:)?[:.[:digit:]]+(, TLS)?$
Thanks,
--
-Jamie L. Penman-Smithson <[EMAIL PROTECTED]>
t: +44 1273 424795; f: +44 1273 424795
PGP: C0A7 955E EED6 A309 23D7 863B C76A 26A3 F0DC FCA8
never send mail to: [EMAIL PROTECTED]
signature.asc
Description: This is a digitally signed message part
