Sorry, insuffiently tested patch - it wasn't catching all the weird stuff that can show up in the helo field...
--- /u3/sid-amd64/etc/logcheck/ignore.d.server/whitelister 2007-01-07 16:28:37.000000000 +0000 +++ ignore.d.server/whitelister 2007-07-05 11:41:09.000000000 +0100 @@ -1,4 +1,4 @@ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ whitelister\[[0-9]+\]: Clean$ -\w{3} [ :0-9]{11} [._[:alnum:]-]+ whitelister\[[0-9]+\]: listening to inet:[:.[:xdigit:]]+:[[:digit:]]$ -\w{3} [ :0-9]{11} [._[:alnum:]-]+ whitelister\[[0-9]+\]: listening to unix:[-/._[:alnum:]]+$ -^\w{3} [ :0-9]{11} [._[:alnum:]-]+ whitelister\[[0-9]+\]: Dirty: RCPT from [[:alnum:[EMAIL PROTECTED]: DUNNO \(blacklisted by [[:alnum:].]+\); from=<[[:alnum:[EMAIL PROTECTED]> to=<[[:alnum:[EMAIL PROTECTED]> proto=SMTP helo=<[[:alnum:[EMAIL PROTECTED]>$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ whitelister\[[0-9]+\]: listening to inet:[:.[:xdigit:]]+:[[:digit:]]$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ whitelister\[[0-9]+\]: listening to unix:[-/._[:alnum:]]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ whitelister\[[0-9]+\]: Dirty: RCPT from [._[:alnum:]-]+\[([0-9.]{7,15}|[0-9a-fA-F:.]{4,39})\]: DUNNO \(blacklisted by [._[:alnum:]-]+\); from=<[[:alnum:[EMAIL PROTECTED]> to=<[[:alnum:[EMAIL PROTECTED]> proto=E?SMTP helo=<[^>]+>$ -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]