Re: Logcheck-Configuration

[Gerhard Engler <gerhard.engler.mailinglist@gmx.de>]

In der ../logcheck-database/README.logcheck-database.gz steht:

TESTING RULES
=============

To test new rules, you can grep your log file, and remove trailing
space with something like this:

   sed -e 's/[[:space:]]*$//' /var/log/syslog | egrep \
   '^\w{3} [ :0-9]{11} oempc wwwoffled\[[0-9]+\]: WWWOFFLE (On|Off)line\.$'

If the log line is displayed, then your regex works.
...

Ein:

gustav:~#  sed -e 's/[[:space:]]*$//' /var/log/syslog | egrep     
'^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: isdn_net: ippp0: dial rejected:'

ergibt:

May  1 09:27:05 gustav kernel: isdn_net: ippp0: dial rejected: interface 
not in dialmode `auto', signalling dst_link_failure
May  1 09:27:05 gustav kernel: isdn_net: ippp0: dial rejected: interface 
not in dialmode `auto', signalling dst_link_failure
...

Damit dürfte doch die Zeile nicht mehr im logcheck erscheinen?

Gerhard