Re: LogCheck and it's rules

1999-12-16 Thread Rob Browning
"Paul J. Keenan" <[EMAIL PROTECTED]> writes: > The logcheck script is in /usr/sbin/logcheck.sh - the script uses > grep to do the pattern matching. From the source and the grep(1) > manpage, it seems that for the lines to include in the log > (logcheck.hacking and logcheck.violations) the matchi

Re: LogCheck and it's rules

1999-12-15 Thread Paul Keenan
Robert Ramiega wrote: > Maybe You are right but then why this: > named[.*]: Cleaned cache of .* RRsets > causes logcheck to exclude matching lines and the line at the top does not > ?? Are you sure it does ? Perhaps there is another line in your ignore file which matches it. That line should

Re: LogCheck and it's rules

1999-12-14 Thread Robert Ramiega
On Tue, Dec 14, 1999 at 08:59:49PM +, Paul J. Keenan wrote: > Robert Ramiega wrote: > > > named[.*]: USAGE .* .* CPU=.*/.* CHILDCPU=.*/.* > > PAM_unix[.*]: (ssh) session opened for user .* by (.*) > > > > and i still get in logcheck mails: > > Dec 13 23:46:53 plukwa named[159]: USAGE 9451252

Re: LogCheck and it's rules

1999-12-14 Thread Paul J. Keenan
Robert Ramiega wrote: > named[.*]: USAGE .* .* CPU=.*/.* CHILDCPU=.*/.* > PAM_unix[.*]: (ssh) session opened for user .* by (.*) > > and i still get in logcheck mails: > Dec 13 23:46:53 plukwa named[159]: USAGE 945125213 945085613 CPU=61.74u/56.5s > CHILDCPU=0u/0s > Dec 13 23:04:55 plukwa PAM_u

Re: LogCheck and it's rules

1999-12-14 Thread Robert Ramiega
On Mon, Dec 13, 1999 at 05:55:57PM -0900, Ethan Benson wrote: > On 13/12/99 Pollywog wrote: > > > > and i still get in logcheck mails: > > > Dec 13 23:46:53 plukwa named[159]: USAGE 945125213 945085613 > > > >try > >named.*: USAGE .* umm i'm not sure if i tried this, but will check it ASAP > > >

RE: LogCheck and it's rules

1999-12-14 Thread Pollywog
On 14-Dec-1999 Ethan Benson wrote: > i like the idea of logcheck but when it sends so much crap it defeats > its purpose. > > since i see its not just me having problems with it perhaps a bug > should be filed, this package is useless out of the box on standard > debian systems. I did not kno

RE: LogCheck and it's rules

1999-12-14 Thread Ethan Benson
On 13/12/99 Pollywog wrote: > and i still get in logcheck mails: > Dec 13 23:46:53 plukwa named[159]: USAGE 945125213 945085613 try named.*: USAGE .* > CPU=61.74u/56.5s CHILDCPU=0u/0s > Dec 13 23:04:55 plukwa PAM_unix[17035]: (ssh) session opened for user root > by > (uid=0) PAM_unix.*: (ssh

RE: LogCheck and it's rules

1999-12-13 Thread Pollywog
On 13-Dec-1999 Robert Ramiega wrote: > Hi! > I'm running Potato on my PPC machine. > I have one problem with logcheck. It seems i can't create proper ignore > rules: here is excerpt from logcheck.ignore: > > named[.*]: USAGE .* .* CPU=.*/.* CHILDCPU=.*/.* > PAM_unix[.*]: (ssh) session opened