On Sun, 2005-02-20 at 12:10 +0100, Ingo Theiss wrote: > the pattern in ignore.d.server pure-ftpd for '[NOTICE] ... uploaded' is > not matching the following message: > > Feb 18 23:06:18 example pure-ftpd: ([EMAIL PROTECTED]) [NOTICE] > /docroot/example.com//htdocs/guradia/plugin/net.php.smarty/libs/plugins/function.assign_debug_info.php > uploaded (1116 bytes, 7.47KB/sec) > > maybe the double '//' is the problem.
The following rule matches those messages:
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pure-ftpd:
\([._[:alnum:[EMAIL PROTECTED]:alnum:]-]+\) \[NOTICE\] .+ (up|down)loaded
\([0-9]+ bytes, [0-9]+.[0-9]+KB/sec\)$
It's been in logcheck since 1.2.29, since you're using 1.2.34 you
shouldn't be seeing those messages..
Make sure you've got that rule in your ignore.d.server/pure-ftpd. Are
those messages showing up as Security Events? Are the permissions on
ignore.d.server/pure-ftpd okay?
--
-jamie <[EMAIL PROTECTED]> | spamtrap: [EMAIL PROTECTED]
w: http://www.silverdream.org | p: [EMAIL PROTECTED]
pgp key @ http://silverdream.org/~jps/pub.key
21:30:02 up 17 min, 2 users, load average: 2.65, 2.52, 1.58
signature.asc
Description: This is a digitally signed message part
