Re: I can't make logcheck ignore some things.

[bmarcum@iglou.com (Bill Marcum)]

On Fri, Feb 11, 2005 at 08:09:50AM +0000, Adam Funk wrote:
> My logcheck output e-mails include the following lines (among others)
> that I want ignored:
> 
> Feb 11 06:35:31 garcia kernel: sda : READ CAPACITY failed.
> Feb 11 06:35:32 garcia kernel: sda : READ CAPACITY failed.
> Feb 11 06:35:44 garcia kernel: sda : READ CAPACITY failed.
> Feb 11 06:39:28 garcia kernel: sda : READ CAPACITY failed.
> 
> So I created a file /etc/logcheck/ignore.d.workstation/af-custom
> (REPORTLEVEL="workstation" in logcheck.conf) and put the following in
> it:
> 
> ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: sda.*$
> 
> When I test this with egrep it should work:
> 
> # egrep '^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel:
> sda.*$' /var/log/kern.log
> Feb  7 06:36:02 garcia kernel: sda: Unit Not Ready, sense:
> Feb  7 06:36:02 garcia kernel: sda : READ CAPACITY failed.
> ....
> 
> But the unwanted lines are still showing up in the the logcheck mails. 
> What am I doing wrong?
> 
You need to put it in violations.ignore.d.