On Wed, Oct 11, 2006 at 09:35:57PM -0400, Kevin Mark wrote: > On Wed, Oct 11, 2006 at 06:08:08PM -0400, Roberto C. Sanchez wrote: > > I have the following line in /etc/logcheck/ignore.d.server/local: > > > > ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ /USR/BIN/CRON\[.*\]: \(root\) CMD \(/usr/sbin/getimage > > > > The level in logcheck.conf is set to server. Still, these lines show up > > in my logcheck messages every hour: > > > > Oct 11 17:06:01 miami /USR/SBIN/CRON[9820]: (root) CMD (/usr/sbin/getimage > > > > I have also tried this line unsuccessfully: > > > > ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ \/USR\/BIN\/CRON\[.*\]: \(root\) CMD \(\/usr\/sbin\/getimage > > > > Can someone spot what I am missing? > > > > Regards, > > > Hi Roberto, > the first thing I noticed: your regex says BIN and the actual line says > SBIN. so this is what I first noticed. Please excuse me while I go and beat head against a brick wall. I guess I have been staring at that stupid regex for so long it just did not click. Thanks. -Roberto -- Roberto C. Sanchez http://people.connexer.com/~roberto http://www.connexer.com
Attachment:
signature.asc
Description: Digital signature