On Sat, 1 Jun 2024, Richard Lewis wrote: > > does not cover log entry > > > > Jan 4 07:23:42 gatling pure-ftpd: (?@203.158.197.21) [INFO] Logout. > > > > The problem is with ? before @. > > It's a shame no-one replied to this bug from 2012 > Is there still interest in adding this rule, and is the above still valid?
Dear Richard, I was not waiting paralyzed till now. :-) I've created a local rule to solve the problem. > is the above message really harmless? it the bit before the @ is meant > to be a username then it looks like something fishy is going on and > this message should not be filtered? AFAIK "?" stands for the username if the session is terminated before logging in. May 26 06:49:14 gatling pure-ftpd: (?@152.32.206.247) [INFO] Logout. May 26 06:49:14 gatling pure-ftpd: (?@152.32.206.247) [INFO] New connection from 152.32.206.247 May 26 06:49:33 gatling pure-ftpd: (?@152.32.206.247) [INFO] Logout. May 26 06:49:33 gatling pure-ftpd: (?@152.32.206.247) [INFO] New connection from 152.32.206.247 May 26 06:49:33 gatling pure-ftpd: (?@152.32.206.247) [INFO] Anonymous user logged in May 26 06:49:33 gatling pure-ftpd: (ftp@152.32.206.247) [INFO] Logout. I think this is quite uninteresting. But it's up to you. Cheers Gabor -- A mug of beer, please. Shaken, not stirred.
