RE: LogCheck and it's rules
On 13-Dec-1999 Robert Ramiega wrote:
> Hi!
> I'm running Potato on my PPC machine.
> I have one problem with logcheck. It seems i can't create proper ignore
> rules: here is excerpt from logcheck.ignore:
>
> named[.*]: USAGE .* .* CPU=.*/.* CHILDCPU=.*/.*
> PAM_unix[.*]: (ssh) session opened for user .* by (.*)
>
> and i still get in logcheck mails:
> Dec 13 23:46:53 plukwa named[159]: USAGE 945125213 945085613
try
named.*: USAGE .*
> CPU=61.74u/56.5s CHILDCPU=0u/0s
> Dec 13 23:04:55 plukwa PAM_unix[17035]: (ssh) session opened for user root
> by
> (uid=0)
PAM_unix.*: (ssh) session opened for user root .*
>
> Those 2 lines (both from logcheck.ignore and logcheck mails) are not the
> only ones (basically any line with named, PAM_unix and so on gets reported
> under Unsual Events and some of those lines came with package and were not
> modified by me).
> Can someone help me?
>
> (just popped into my head... does th case of regex matter? it's the same as
> in /var/log/messages but....)
I believe case DOES matter with logcheck.
--
Andrew
Reply to: