Re: Debian Sarge Logcheck Query
----- Original Message -----
From: "Brian Brazil" <bbrazil@netsoc.tcd.ie>
To: <debian-user@lists.debian.org>
Sent: Monday, February 16, 2004 9:19 PM
Subject: Re: Debian Sarge Logcheck Query
> On Mon, Feb 16, 2004 at 09:02:18PM +1000, Peter A. Cole wrote:
> > I'm using logcheck to get notifications on my Debian Sarge box, but I
would
> > really like to get rid of a few extra messages that can be ignored. The
> > entries I want to ignore are:
> >
>
> The $ at the end is your problem. This matches the end of the string.
>
> Quote the (). Also the '.'s should be quoted but it isn't really as
> important. (v.4.0.5) -> \(v4.0.5\) or \(v4\.0\.5\) There was an extra
> dot in there.
>
> Ditto for these
>
> Also you might want to get rid of everything before 'in.qpopper' -
> unless you are dealing with multiple systems.
>
> Don't think theres any more problems but I could have missed something.
>
>
> Extended regular expressions. 'man grep' for more information.
>
> Brian
>
Thanks a heap Brian!!
You were spot on the money there and didn't miss a thing :-)
In fact logcheck didn't even send an email a minute ago when I check, which
is how I want except for reboots and unexpected events.
For my own curiosity, I'll have a look at the grep man pages and see if I
can't understand what's going on a bit better for myself.
Thanks again for your quick help.
Pete
Reply to: