"stat=Deferred" is a very common log message from sendmail, that gets written any time an e-mail can't be delivered right away. It not something you generally need (or want) to consider a security violation every time it happens.
Any other message you want to ignore or demote can be added the same way. Save a unique chunk of it into logcheck.ignore (wildcards work), and you won't see it any more. If you're being told it's a security violation and don't want to, put the identifying string into "locheck.violations.ignore" "Stephen E. Hargrove" wrote: My logcheck.violations.ignore file contains only one line: > > stat=Deferred
