[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: logcheck problem

On Thu, 6 Dec 2001 17:19:49 +0100 (CET) "Tille, Andreas" <TilleA@rki.de> wrote:

> Hello,
> I suspect something is brocken with the latest logcheck.  I continuousely
> get the appended message.  I do not think that it is caused by my exclude rules
> because I did not change anything important (and even if it is a bug logcheck
> should care about!).

(... logcheck v 1.1.1-12 ...)

> ---------- Forwarded message ----------
> Date: Thu, 06 Dec 2001 16:02:03 +0100
> From: Cron Daemon <tillea@rki.de>
> To: tillea@rki.de
> Subject: Cron <root@wr-limob01> test -x /usr/sbin/logcheck && nice -n10
>     /usr/sbin/logcheck
> egrep: Invalid content of \{\}

I get the same message with my current version of logcheck. (1.1.1-13.1)

I first tried running the command:

for f in `find /etc/logcheck/ -type f`;do
  echo "testing inverted" | egrep -vf $f;
  echo "testing normal" | egrep -if $f;

And got no errors from egrep.

I then attempted to find out where the error occures, by running the logcheck-
script manually as root, and watching for the egrep-error message. But with
inconsisten results.

Has anyone else seen this error ? The main problem is obviously that the logcheck-script
doesn't catch and report errors that occures when processing pattern-files. So it's
almost impossible to find the error, if indeed it is in the pattern-files.

I don't really understand what causes this because it appears to be highly inconsistent,
and doesn't show up on every run.

I made a further attempt by adding the following lines to a modifed locheck-script,
and running it manually to genereate an error log, again watching for the egrep
error, and trying to see where it manifested -- but I got inconsistent results. I
believe this is because of logtail and the way logcheck works -- by only checking the
logs that are new, and only using specific ("needed") filter-files.


grep_debug() {
   echo "egrep called with: $*" >> $ERRORLOG
   egrep $*

#Note: the following should replace GREP=egrep
if [[ $DEBUG > 0 ]]; then
   trap "echo 'ERROR TRAPPED***' >> $ERRORLOG;echo Trapped error! > /dev/stderr" ERR

One one run witch genereated the egrep error above (egrep: Invalid content of \{\})
the error appears to be in one of the ignore-files:

egrep called with: -v -f /var/lib/logcheck/cleaned/logcheck.violations.ignore

Please reply to me as well the list, as I'm not on it. Sorry for no correct in-reply-to-
header, but I found the original post on the web, and found no "full-headers"-link.
Eirik Schwenke

Reply to: