Re: logcheck

[Richard Hector <richard@walnut.gen.nz>]

On Mon, Jan 10, 2005 at 10:08:17AM -0600, Rodney Richison wrote:
> 
> 
> Dave Ewart wrote:
> 
> >Add the expression:
> >
> >amavisd-new.*Passed
> >
> >to the appropriate logcheck
> >
> That's part of the problem. While 
> http://www.debian.org/doc/manuals/securing-debian-howto/ch4.en.html says 
> add it to this file |/etc/logcheck/ignore.d.reportlevel/local it does 
> not exist. However, there is a file in 
> ||/etc/logcheck/ignore.d.reportlevel/amavisd-new   I just now put this 
> in it amavis\[[0-9]+\]: +(\([-0-9]+\) +)?Passed

You can create the file; any file in that directory will be read. If you
have lots of logcheck rules for different purposes, you may want to split
them out, using filenames like amavis-local etc.

Richard