Package: logcheck-database Version: 1.2.68 Severity: minor This is also present in the current squeeze/sid version 1.3.7
For weeks I have been slowly driven mad by logcheck continually reporting innocuous nfs mount/umount events and I could not see why they were not being removed by the nfs ignore rules. Finally I spotted the issue: the mount path listed in the log message contains an underscore, so doesn't quite match the regexp. Attached is the very simple patch that allows [._[:alnum:]-]* in path elements. -- System Information: Debian Release: 5.0.4 Architecture: amd64 (x86_64) Kernel: Linux 2.6.18-5-xen-amd64 (SMP w/2 CPU cores) Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash -- debconf-show failed
--- nfs 2010-03-25 10:47:47.000000000 +0000 +++ nfs.orig 2010-03-25 10:47:00.000000000 +0000 @@ -1,2 +1,2 @@ -^\w{3} [ :0-9]{11} [._[:alnum:]-]+ rpc\.mountd: authenticated (un|)mount request from [._[:alnum:]-]+:[0-9]+ for (/[._[:alnum:]-]*)+ \((/[._[:alnum:]-]*)+\)$ -^\w{3} [ :0-9]{11} [._[:alnum:]-]+ mountd\[[0-9]+\]: authenticated (un|)mount request from [._[:alnum:]-]+:[0-9]+ for (/[._[:alnum:]-]*)+ \((/[._[:alnum:]-]*)+\)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ rpc\.mountd: authenticated (un|)mount request from [._[:alnum:]-]+:[0-9]+ for (/[[:alnum:]]*)+ \((/[[:alnum:]]*)+\)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ mountd\[[0-9]+\]: authenticated (un|)mount request from [._[:alnum:]-]+:[0-9]+ for (/[[:alnum:]]*)+ \((/[[:alnum:]]*)+\)$
_______________________________________________ Logcheck-devel mailing list Logcheck-devel@lists.alioth.debian.org http://lists.alioth.debian.org/mailman/listinfo/logcheck-devel