Re: LogCheck and it's rules
On Tue, Dec 14, 1999 at 08:59:49PM +0000, Paul J. Keenan wrote:
> Robert Ramiega wrote:
> <snip>
> > named[.*]: USAGE .* .* CPU=.*/.* CHILDCPU=.*/.*
> > PAM_unix[.*]: (ssh) session opened for user .* by (.*)
> >
> > and i still get in logcheck mails:
> > Dec 13 23:46:53 plukwa named[159]: USAGE 945125213 945085613 CPU=61.74u/56.5s CHILDCPU=0u/0s
> > Dec 13 23:04:55 plukwa PAM_unix[17035]: (ssh) session opened for user root by
> > (uid=0)
> >
> Your patterns don't match because the brackets [] are treated as
> metacharacters
> and you need to escape them to match : "named\[.*\]:" (minus the
> quotes).
Maybe You are right but then why this:
named[.*]: Cleaned cache of .* RRsets
causes logcheck to exclude matching lines and the line at the top does not
??
>
> The logcheck script is in /usr/sbin/logcheck.sh - the script uses grep
> to do the pattern matching. From the source and the grep(1) manpage,
I know =o)) Thats why it amazes me...............
--
Robert Ramiega | robert@pdi.net IRC: _Jedi_ | Don't underestimate
UIN: 13201047 | http://plukwa.pdi.net/ | the power of Source
Reply to: