logcheck: A bunch of separation work and added stuff.

3 files changed, 15 insertions, 14 deletions

diff --git a/logcheck/ignore.d.server/local b/logcheck/ignore.d.server/local
index 7c2dae7..40a3c41 100644
--- a/logcheck/ignore.d.server/local
+++ b/logcheck/ignore.d.server/local
@@ -1,4 +1,3 @@
-named\[.*\]: .*: query\(.*\) NS points to CNAME \(.*\)
 dhcpd.*: Abandoning IP address .*: pinged before offer
 dhcpd.*: DHCPINFORM from [[:digit:]]+\.[[:digit:]]+\.[[:digit:]]+\.[[:digit:]]+( via eth.)?
 dhcpd.*: DHCPNACK on [\.[:digit:]]+ to [[:alnum:]]+( via eth.)?
@@ -21,7 +20,6 @@ FaxGetty\[.*\]: ANSWER: Ring detected without successful handshake
 FaxGetty\[.*\]: ANSWER: FAX CONNECTION
 FaxQueuer\[.*\]: SUBMIT JOB [[:digit:]]+
 FaxSend\[.*\]: SEND FAX: JOB [[:digit:]]+ DEST [[:digit:]]+ COMMID [[:digit:]]+
-gdm\[.*\]: run_pictures: Directory .* does not exist\.
 gnu-imap4d\[.*\]: Incoming connection opened
 gnu-imap4d\[.*\]: connect from [\.[:digit:]]+
 gnu-imap4d\[.*\]: User '[[:alnum:]]+' logged in
@@ -45,6 +43,7 @@ ircd\[.*\]: Server Ready
 (ircd\[.*\]: )?binding stream socket [\.[:alnum:]]+\[\*\.666[789]\]: Address already in use
 IMP\[.*\]: Login .* to .*:143 as .*
 kernel: Packet log: input DENY eth[[:digit:]]+ PROTO=17 .*:(137|138) .*:(137|138) L=[[:digit:]]+ S=0x00 I=[[:digit:]]+ F=0x0000 T=[[:digit:]]+ \(#[[:digit:]]+\)
+named\[.*\]: .*: query\(.*\) NS points to CNAME \(.*\)
 named\[.*\]: NSTATS [[:digit:]]+ [[:digit:]]+
 named\[.*\]: .* All possible .* lame
 ntpd\[.*\]: kern_enable is 1
@@ -53,18 +52,6 @@ ntpd\[.*\]: ntpd 4\.[01]\..* \([12]\)
 ntpd\[.*\]: precision = [[:digit:]]+ usec
 ntpd\[.*\]: signal_no_reset: signal 13 had flags [[:digit:]]+
 ntpd\[.*\]: using kernel phase-lock loop [[:digit:]]+
-postfix.* table has changed -- exiting
-postfix/local\[.*\]: warning: unable to create lock file /var/mail/[[:alnum:]]+\.lock: Permission denied
-postfix/smtp\[.*\]: .*: to=<.*>, relay=none, delay=[[:digit:]]+, status=deferred \(connect to .*\[.*\]: (Connection refused|server refused mail service)\)
-postfix/smtp\[.*\]: connect to .*\[.*\]: (Connection (refused|timed out)|read timeout|server (refused mail service|dropped connection)|No route to host) \(port 25\)
-postfix/smtp\[.*\]: warning: numeric domain name in resource data of MX record for .*: [\.[:digit:]]+
-postfix/smtp\[.*\]: warning: no MX host for [\.[:alnum:]-]+ has a valid A record
-postfix/smtp\[.*\]: warning: host [\.[:alnum:]-]+\[[\.[:digit:]]+\] (greeted me|replied to HELO/EHLO) with my own hostname [\.[:alnum:]-]+
-postfix/smtpd\[.*\]: (lost connection|timeout) after [^ ]+ from [\.[:alnum:]-]+\[[\.[:digit:]]+\]
-postfix/smtpd\[.*\]: warning: .*: address not listed for hostname .*
-postfix/smtpd\[.*\]: warning: .*: hostname [\.[:alnum:]-]+ verification failed: Host (name has no address|not found)
-proftpd\[.*\]: .* \(.*\) - FTP session opened\.
-proftpd\[.*\]: .* \(.*\) - USER (anonymous|ftp) \(Login failed\): Can't find user\.
 pop-before-smtp\[.*\]: (opening|closing) relay for [\.[:digit:]]+( --- not in mynetworks)?
 smbd\[.*\]:   read_socket_data: recv failure for 4\. Error = Connection reset by peer
 smbd\[.*\]: \[.*\] lib/util_sock.c:read_socket_data\([[:digit:]]+\)
diff --git a/logcheck/ignore.d.server/postfix b/logcheck/ignore.d.server/postfix
new file mode 100644
index 0000000..d960c37
--- /dev/null
+++ b/logcheck/ignore.d.server/postfix
@@ -0,0 +1,10 @@
+postfix.* table has changed -- exiting
+postfix/local\[.*\]: warning: unable to create lock file /var/mail/[[:alnum:]]+\.lock: Permission denied
+postfix/smtp\[.*\]: .*: to=<.*>, relay=none, delay=[[:digit:]]+, status=deferred \(connect to .*\[.*\]: (Connection refused|server refused mail service)\)
+postfix/smtp\[.*\]: connect to .*\[.*\]: (Connection (refused|timed out)|read timeout|server (refused mail service|dropped connection)|No route to host) \(port 25\)
+postfix/smtp\[.*\]: warning: numeric domain name in resource data of MX record for .*: [\.[:digit:]]+
+postfix/smtp\[.*\]: warning: no MX host for [\.[:alnum:]-]+ has a valid A record
+postfix/smtp\[.*\]: warning: host [\.[:alnum:]-]+\[[\.[:digit:]]+\] (greeted me|replied to HELO/EHLO) with my own hostname [\.[:alnum:]-]+
+postfix/smtpd\[.*\]: (lost connection|timeout) after [^ ]+ from [\.[:alnum:]-]+\[[\.[:digit:]]+\]
+postfix/smtpd\[.*\]: warning: .*: address not listed for hostname .*
+postfix/smtpd\[.*\]: warning: .*: hostname [\.[:alnum:]-]+ verification failed: Host (name has no address|not found)
diff --git a/logcheck/ignore.d.server/proftpd b/logcheck/ignore.d.server/proftpd
new file mode 100644
index 0000000..10e8f74
--- /dev/null
+++ b/logcheck/ignore.d.server/proftpd
@@ -0,0 +1,4 @@
+proftpd\[.*\]: .* \(.*\) - FTP session opened\.
+proftpd\[.*\]: .* \(.*\) - USER (anonymous|ftp) \(Login failed\): Can't find user\.
+proftpd\[.*\]: connect from [\.[:digit:]]+
+proftpd\[.*\]: No certificate files found!