LogCheck and it's rules
Hi!
I'm running Potato on my PPC machine.
I have one problem with logcheck. It seems i can't create proper ignore
rules: here is excerpt from logcheck.ignore:
named[.*]: USAGE .* .* CPU=.*/.* CHILDCPU=.*/.*
PAM_unix[.*]: (ssh) session opened for user .* by (.*)
and i still get in logcheck mails:
Dec 13 23:46:53 plukwa named[159]: USAGE 945125213 945085613 CPU=61.74u/56.5s CHILDCPU=0u/0s
Dec 13 23:04:55 plukwa PAM_unix[17035]: (ssh) session opened for user root by
(uid=0)
Those 2 lines (both from logcheck.ignore and logcheck mails) are not the
only ones (basically any line with named, PAM_unix and so on gets reported
under Unsual Events and some of those lines came with package and were not
modified by me).
Can someone help me?
(just popped into my head... does th case of regex matter? it's the same as
in /var/log/messages but....)
--
Robert Ramiega | robert@pdi.net IRC: _Jedi_ | Don't underestimate
UIN: 13201047 | http://plukwa.pdi.net/ | the power of Source
Reply to: