Re: logcheck struggle

[Richard Hector <richard@walnut.gen.nz>]

On Wed, Sep 29, 2004 at 11:35:57PM +0200, Pim Bliek wrote:
> Hi All,
> 
> I am no regular expression guru, and I am having severe difficulties
> adjusting logcheck to my needs (on a Sid system).
> 
> I get the following stuff mailed by logcheck from my syslog which I
> don't want to see:
> Sep 29 23:02:02 srv1 postfix/smtpd[29293]: _sasl_plugin_load failed on
> sasl_auxprop_plug_init for plugin: sql
> Sep 29 23:02:02 srv1 postfix/smtpd[29293]: sql_select option missing
> Sep 29 23:02:02 srv1 postfix/smtpd[29293]: auxpropfunc error no
> mechanism available
> 
> I created the following rules at the bottom of the postfix file in
> /etc/ignore.d.server/:
> ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/lmtp\[[0-9]+\]:
> _sasl_plugin_load failed on sasl_auxprop_plug_init for plugin: sql$
> ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/lmtp\[[0-9]+\]: sql_select
> option missing$
> ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/lmtp\[[0-9]+\]: auxpropfunc
> error no mechanism available$
> 
> I got the ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/lmtp\[[0-9]+\]:
> part from other lines in the same file.

You're looking for lmtp instead of smtpd - are there other lines you
could work from instead?

Also, you may find that the first and last lines will come through
anyway in the "Possible Security Violations" section, because they
contain evil words like "fail" and "error" - you'll need to edit other
files to stop those, but do it carefully - it's easy to just ignore
everything by mistake.

Richard