From 2bb63b0b81fb7aec533eaf645591426662e17124 Mon Sep 17 00:00:00 2001 From: Jonas Smedegaard Date: Sun, 22 Feb 2004 10:23:41 +0000 Subject: Tighten all rules to strict left side, based on su rules. --- logcheck/ignore.d.server/amanda | 2 +- logcheck/ignore.d.server/amavis | 14 +- logcheck/ignore.d.server/anacron | 16 +- logcheck/ignore.d.server/bind.changes | 46 +- logcheck/ignore.d.server/bind.tmp | 4 +- logcheck/ignore.d.server/courier | 34 +- logcheck/ignore.d.server/dancer-ircd | 6 +- logcheck/ignore.d.server/dhcp-client | 8 +- logcheck/ignore.d.server/dhcp.changes | 14 +- logcheck/ignore.d.server/dhcp3-common | 24 +- logcheck/ignore.d.server/gdm | 2 +- logcheck/ignore.d.server/gdm.da_DK | 8 +- logcheck/ignore.d.server/hotplug | 8 +- logcheck/ignore.d.server/hylafax-server | 20 +- logcheck/ignore.d.server/imp | 2 +- logcheck/ignore.d.server/libgpmg1 | 2 +- logcheck/ignore.d.server/libgpmg1.da_DK | 2 +- logcheck/ignore.d.server/libpam-modules | 2 +- logcheck/ignore.d.server/local | 710 ++++++++++++++-------------- logcheck/ignore.d.server/mailutils-imap4d | 10 +- logcheck/ignore.d.server/misc | 16 +- logcheck/ignore.d.server/murasaki | 14 +- logcheck/ignore.d.server/nagios | 4 +- logcheck/ignore.d.server/netatalk.changes | 60 +-- logcheck/ignore.d.server/netsaint | 10 +- logcheck/ignore.d.server/nfs-kernel-server | 6 +- logcheck/ignore.d.server/non-debian | 12 +- logcheck/ignore.d.server/ntp-simple.changes | 12 +- logcheck/ignore.d.server/pop-before-smtp | 2 +- logcheck/ignore.d.server/postfix | 82 ++-- logcheck/ignore.d.server/postgresql | 4 +- logcheck/ignore.d.server/ppp | 18 +- logcheck/ignore.d.server/proftpd | 14 +- logcheck/ignore.d.server/rpld | 2 +- logcheck/ignore.d.server/samba | 4 +- logcheck/ignore.d.server/sfs-client | 4 +- logcheck/ignore.d.server/sfs-server | 4 +- logcheck/ignore.d.server/spamassassin | 10 +- logcheck/ignore.d.server/squid | 20 +- logcheck/ignore.d.server/ssh | 22 +- logcheck/ignore.d.server/ssmtp | 2 +- logcheck/ignore.d.server/sysklogd | 2 +- logcheck/ignore.d.server/tftpd | 4 +- logcheck/ignore.d.server/tmp | 154 +++--- logcheck/ignore.d.server/ucd-snmp | 2 +- logcheck/ignore.d.server/uptimed | 2 +- 46 files changed, 710 insertions(+), 710 deletions(-) (limited to 'logcheck/ignore.d.server') diff --git a/logcheck/ignore.d.server/amanda b/logcheck/ignore.d.server/amanda index 7a6ab62..21026ee 100644 --- a/logcheck/ignore.d.server/amanda +++ b/logcheck/ignore.d.server/amanda @@ -1 +1 @@ -amandad\[[0-9]+\]: connect from +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ amandad\[[0-9]+\]: connect from diff --git a/logcheck/ignore.d.server/amavis b/logcheck/ignore.d.server/amavis index e808f67..142f9d6 100644 --- a/logcheck/ignore.d.server/amavis +++ b/logcheck/ignore.d.server/amavis @@ -1,7 +1,7 @@ -amavis\[[0-9]+\]: cached [a-f0-9]+ from <[^[:space:]]*>$ -amavis\[[0-9]+\]: infected \([^[:space:]]+\), from=<[^[:space:]]+>, to=<[^[:space:]]+>, quarantine virus-[0-9-]+$ -amavis\[[0-9]+\]: local delivery: <[^[:space:]]*> -> <(spam|virus)-quarantine>, mbx=/var/lib/amavis/virusmails/(spam|virus)-[[:alnum:]-]+(\.gz)?$ -amavis\[[0-9]+\]: mail checking ended: (DISCARD|REJECT)$ -amavis\[[0-9]+\]: spam from=(<[^>]+>|\(\?\)), to=(<[^>]+>,)+ quarantine spam-[0-9a-f-]+$ -amavis\[[0-9]+\]: spam_scan: (No|Yes), hits=[\.0-9-]+ tests=[,_A-Z0-9]+ <[^>]*>$ -amavis\[[0-9]+\]: spam_scan: whitelisted sender <[^[:space:]]+>, spam check skipped$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ amavis\[[0-9]+\]: cached [a-f0-9]+ from <[^[:space:]]*>$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ amavis\[[0-9]+\]: infected \([^[:space:]]+\), from=<[^[:space:]]+>, to=<[^[:space:]]+>, quarantine virus-[0-9-]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ amavis\[[0-9]+\]: local delivery: <[^[:space:]]*> -> <(spam|virus)-quarantine>, mbx=/var/lib/amavis/virusmails/(spam|virus)-[[:alnum:]-]+(\.gz)?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ amavis\[[0-9]+\]: mail checking ended: (DISCARD|REJECT)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ amavis\[[0-9]+\]: spam from=(<[^>]+>|\(\?\)), to=(<[^>]+>,)+ quarantine spam-[0-9a-f-]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ amavis\[[0-9]+\]: spam_scan: (No|Yes), hits=[\.0-9-]+ tests=[,_A-Z0-9]+ <[^>]*>$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ amavis\[[0-9]+\]: spam_scan: whitelisted sender <[^[:space:]]+>, spam check skipped$ diff --git a/logcheck/ignore.d.server/anacron b/logcheck/ignore.d.server/anacron index 88498d3..e44d69e 100644 --- a/logcheck/ignore.d.server/anacron +++ b/logcheck/ignore.d.server/anacron @@ -1,8 +1,8 @@ -/USR/SBIN/CRON\[[0-9]+\]: \(root\) CMD \(test -e /usr/sbin/anacron || run-parts --report /etc/cron.(daily|weekly|monthly)\) $ -anacron\[[0-9]+\]: Anacron 2.3 started on [0-9-]+$ -anacron\[[0-9]+\]: Job `cron.(daily|weekly|monthly)' started$ -anacron\[[0-9]+\]: Job `cron.(daily|weekly|monthly)' terminated( \(exit status: 1\))?( \(mailing output\))?$ -anacron\[[0-9]+\]: Jobs will be executed sequentially$ -anacron\[[0-9]+\]: Normal exit \([0-9]+ jobs run\)$ -anacron\[[0-9]+\]: Updated timestamp for job `cron.(daily|weekly|monthly)' to [0-9-]+$ -anacron\[[0-9]+\]: Will run job `cron.(daily|weekly|monthly)' in (5|10|15) min\.$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ /USR/SBIN/CRON\[[0-9]+\]: \(root\) CMD \(test -e /usr/sbin/anacron || run-parts --report /etc/cron.(daily|weekly|monthly)\) $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ anacron\[[0-9]+\]: Anacron 2.3 started on [0-9-]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ anacron\[[0-9]+\]: Job `cron.(daily|weekly|monthly)' started$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ anacron\[[0-9]+\]: Job `cron.(daily|weekly|monthly)' terminated( \(exit status: 1\))?( \(mailing output\))?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ anacron\[[0-9]+\]: Jobs will be executed sequentially$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ anacron\[[0-9]+\]: Normal exit \([0-9]+ jobs run\)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ anacron\[[0-9]+\]: Updated timestamp for job `cron.(daily|weekly|monthly)' to [0-9-]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ anacron\[[0-9]+\]: Will run job `cron.(daily|weekly|monthly)' in (5|10|15) min\.$ diff --git a/logcheck/ignore.d.server/bind.changes b/logcheck/ignore.d.server/bind.changes index 49328b2..1477317 100644 --- a/logcheck/ignore.d.server/bind.changes +++ b/logcheck/ignore.d.server/bind.changes @@ -1,23 +1,23 @@ -named\[[0-9]+\]: Lame delegation -named\[[0-9]+\]: Lame server on '[^[:space:]]+' \(in '[^[:space:]]+'\?\): \[[\.0-9]+\]\.[0-9]+ '[^[:space:]]+'$ -named\[[0-9]+\]: Response from -named\[[0-9]+\]: reloading -named\[[0-9]+\]: Cleaned cache of [0-9]+ RRsets$ -named\[[0-9]+\]: Sent NOTIFY for [^[:space:]]+$ -named\[[0-9]+\]: approved AXFR from [^[:space:]]+ for [^[:space:]]+$ -named\[[0-9]+\]: zone transfer \(AXFR\) of [^[:space:]]+ to [^[:space:]]+$ -named\[[0-9]+\]: suppressing duplicate notify$ -named\[[0-9]+\]: USAGE [0-9]+ [0-9]+ CPU=[\.0-9]+u/[\.0-9]+s CHILDCPU=[\.0-9]+u/[\.0-9]+s$ -named\[[0-9]+\]: NSTATS [0-9]+ [0-9]+( (38|A|AAAA|ANY|AXFR|CNAME|IXFR|MX|NS|PTR|SOA|TXT)=[0-9]+)*$ -named\[[0-9]+\]: XSTATS [0-9]+ [0-9]+( (RR|RNXD|RFwdR|RDupR|RFail|RFErr|RErr|RAXFR|RLame|ROpts|SSysQ|SAns|SFwdQ|SDupQ|SErr|RQ|RIQ|RFwdQ|RDupQ|RTCP|SFwdR|SFail|SFErr|SNaAns|SNXD|RUQ|RURQ|RUXFR|RUUpd)=[0-9]+)*$ -named\[[0-9]+\]: lame server resolving '[^[:space:]]+' \(in '[^[:space:]]+'\?\): [\.0-9.]+#[0-9]+$ -named\[[0-9]+\]: Received NOTIFY answer -named\[[0-9]+\]: (master |slave )?zone "[^[:space:]]+" \(IN\) loaded \(serial [0-9]+\)$ -named\[[0-9]+\]: (ns_forw|ns_resp|sysquery): query\([^[:space:]]+\) (NS points to CNAME \([^[:space:]]+\)|No possible A RRs|All possible A RR's lame|Bogus LOOPBACK A RR \([^[:space:]]+\))( learnt \([^[:space:]]+\))?$ -named\[[0-9]+\]: client [\.0-9.]+#[0-9]+: transfer of '[^[:space:]]+/IN': AXFR(-style IXFR)? started$ -named\[[0-9]+\]: zone [^[:space:]]+: transfered serial [0-9]+$ -named\[[0-9]+\]: transfer of '[^[:space:]]+' from [^[:space:]]+: end of transfer$ -named\[[0-9]+\]: zone [^[:space:]]+/IN: sending notifies \(serial [0-9]+\)$ -named\[[0-9]+\]: rcvd NOTIFY\([^[:space:]]+, IN, SOA\) from \[[\.0-9]+\]\.[0-9]+$ -named\[[0-9]+\]: late CNAME in answer section for [^[:space:]]+$ -named\[[0-9]+\]: unrelated additional info '[^[:space:]]+' type A from \[[\.0-9]+\]\.[0-9]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: Lame delegation +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: Lame server on '[^[:space:]]+' \(in '[^[:space:]]+'\?\): \[[\.0-9]+\]\.[0-9]+ '[^[:space:]]+'$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: Response from +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: reloading +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: Cleaned cache of [0-9]+ RRsets$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: Sent NOTIFY for [^[:space:]]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: approved AXFR from [^[:space:]]+ for [^[:space:]]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: zone transfer \(AXFR\) of [^[:space:]]+ to [^[:space:]]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: suppressing duplicate notify$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: USAGE [0-9]+ [0-9]+ CPU=[\.0-9]+u/[\.0-9]+s CHILDCPU=[\.0-9]+u/[\.0-9]+s$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: NSTATS [0-9]+ [0-9]+( (38|A|AAAA|ANY|AXFR|CNAME|IXFR|MX|NS|PTR|SOA|TXT)=[0-9]+)*$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: XSTATS [0-9]+ [0-9]+( (RR|RNXD|RFwdR|RDupR|RFail|RFErr|RErr|RAXFR|RLame|ROpts|SSysQ|SAns|SFwdQ|SDupQ|SErr|RQ|RIQ|RFwdQ|RDupQ|RTCP|SFwdR|SFail|SFErr|SNaAns|SNXD|RUQ|RURQ|RUXFR|RUUpd)=[0-9]+)*$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: lame server resolving '[^[:space:]]+' \(in '[^[:space:]]+'\?\): [\.0-9.]+#[0-9]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: Received NOTIFY answer +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: (master |slave )?zone "[^[:space:]]+" \(IN\) loaded \(serial [0-9]+\)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: (ns_forw|ns_resp|sysquery): query\([^[:space:]]+\) (NS points to CNAME \([^[:space:]]+\)|No possible A RRs|All possible A RR's lame|Bogus LOOPBACK A RR \([^[:space:]]+\))( learnt \([^[:space:]]+\))?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: client [\.0-9.]+#[0-9]+: transfer of '[^[:space:]]+/IN': AXFR(-style IXFR)? started$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: zone [^[:space:]]+: transfered serial [0-9]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: transfer of '[^[:space:]]+' from [^[:space:]]+: end of transfer$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: zone [^[:space:]]+/IN: sending notifies \(serial [0-9]+\)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: rcvd NOTIFY\([^[:space:]]+, IN, SOA\) from \[[\.0-9]+\]\.[0-9]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: late CNAME in answer section for [^[:space:]]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: unrelated additional info '[^[:space:]]+' type A from \[[\.0-9]+\]\.[0-9]+$ diff --git a/logcheck/ignore.d.server/bind.tmp b/logcheck/ignore.d.server/bind.tmp index ba68c79..23d3f02 100644 --- a/logcheck/ignore.d.server/bind.tmp +++ b/logcheck/ignore.d.server/bind.tmp @@ -1,2 +1,2 @@ -named\[[0-9]+\]: zone .*: refresh: failure trying master .*: timed out$ -named\[[0-9]+\]: client [\.0-9]+#[0-9]+: update forwarding denied$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: zone .*: refresh: failure trying master .*: timed out$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: client [\.0-9]+#[0-9]+: update forwarding denied$ diff --git a/logcheck/ignore.d.server/courier b/logcheck/ignore.d.server/courier index 5c36114..0bce4c8 100644 --- a/logcheck/ignore.d.server/courier +++ b/logcheck/ignore.d.server/courier @@ -1,17 +1,17 @@ -courierpop3login: Connection, ip=\[::ffff:.*\] -courierpop3login: LOGIN, user=.*, ip=\[::ffff:.*\] -courierpop3login: LOGOUT, user=.*, ip=\[::ffff:.*\], top=.* retr=.* -courierpop3login: Disconnected, ip=\[::ffff:.*\] -courierpop3login: TIMEOUT, user=.*, ip=\[::ffff:.*\], top=0, retr=0 -pop3d-ssl: Connection, ip=\[::ffff:.*\] -pop3d-ssl: LOGIN, user=.*, ip=\[::ffff:.*\] -pop3d-ssl: LOGOUT, user=.*, ip=\[::ffff:.*\], top=.*, retr=.* -pop3d-ssl: TIMEOUT, user=.*, ip=\[::ffff:.*\],top=.*, retr=.* -imaplogin: Connection, ip=\[::ffff:.*\] -imaplogin: LOGIN, user=.*, ip=\[::ffff:.*\] -imaplogin: LOGOUT, user=.*, ip=\[::ffff:.*\], headers=.* body=.* -imaplogin: DISCONNECTED, user=.*, ip=\[::ffff:.*\].* -imapd-ssl: LOGOUT, user=.*, ip=\[::ffff:.*\], headers=.* body=.* -imapd-ssl: Connection, ip=\[::ffff:.*\] -imapd-ssl: LOGIN, user=.*, ip=\[::ffff:.*\] -imapd-ssl: DISCONNECTED, user=.*, ip=\[::ffff:.*\] +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ courierpop3login: Connection, ip=\[::ffff:.*\] +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ courierpop3login: LOGIN, user=.*, ip=\[::ffff:.*\] +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ courierpop3login: LOGOUT, user=.*, ip=\[::ffff:.*\], top=.* retr=.* +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ courierpop3login: Disconnected, ip=\[::ffff:.*\] +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ courierpop3login: TIMEOUT, user=.*, ip=\[::ffff:.*\], top=0, retr=0 +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pop3d-ssl: Connection, ip=\[::ffff:.*\] +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pop3d-ssl: LOGIN, user=.*, ip=\[::ffff:.*\] +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pop3d-ssl: LOGOUT, user=.*, ip=\[::ffff:.*\], top=.*, retr=.* +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pop3d-ssl: TIMEOUT, user=.*, ip=\[::ffff:.*\],top=.*, retr=.* +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ imaplogin: Connection, ip=\[::ffff:.*\] +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ imaplogin: LOGIN, user=.*, ip=\[::ffff:.*\] +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ imaplogin: LOGOUT, user=.*, ip=\[::ffff:.*\], headers=.* body=.* +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ imaplogin: DISCONNECTED, user=.*, ip=\[::ffff:.*\].* +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ imapd-ssl: LOGOUT, user=.*, ip=\[::ffff:.*\], headers=.* body=.* +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ imapd-ssl: Connection, ip=\[::ffff:.*\] +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ imapd-ssl: LOGIN, user=.*, ip=\[::ffff:.*\] +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ imapd-ssl: DISCONNECTED, user=.*, ip=\[::ffff:.*\] diff --git a/logcheck/ignore.d.server/dancer-ircd b/logcheck/ignore.d.server/dancer-ircd index 8c0475a..ab1e569 100644 --- a/logcheck/ignore.d.server/dancer-ircd +++ b/logcheck/ignore.d.server/dancer-ircd @@ -1,3 +1,3 @@ -ircd\[[0-9]+\]: ircd exiting: autodie$ -ircd\[[0-9]+\]: Server Ready$ -(ircd\[[0-9]+\]: )?binding stream socket [\.[:alnum:]]+\[\*\.666[789]\]: Address already in use$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ircd\[[0-9]+\]: ircd exiting: autodie$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ircd\[[0-9]+\]: Server Ready$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ (ircd\[[0-9]+\]: )?binding stream socket [\.[:alnum:]]+\[\*\.666[789]\]: Address already in use$ diff --git a/logcheck/ignore.d.server/dhcp-client b/logcheck/ignore.d.server/dhcp-client index 854b4c5..7c1991e 100644 --- a/logcheck/ignore.d.server/dhcp-client +++ b/logcheck/ignore.d.server/dhcp-client @@ -1,5 +1,5 @@ # NB: dhcp 2-x entries are in dhcp -dhclient(-2.2.x)?: DHCP(REQUEST|DISCOVER) on [^[:space:]]+ to [\.0-9]+ port 67( interval [0-9]+)?$ -dhclient(-2.2.x)?: DHCP(ACK|OFFER) from [\.0-9]+$ -dhclient(-2.2.x)?: bound to [\.0-9]+ -- renewal in [0-9]+ seconds\.$ -dhclient(-2.2.x)?: irda0: unknown hardware address type 783$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhclient(-2.2.x)?: DHCP(REQUEST|DISCOVER) on [^[:space:]]+ to [\.0-9]+ port 67( interval [0-9]+)?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhclient(-2.2.x)?: DHCP(ACK|OFFER) from [\.0-9]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhclient(-2.2.x)?: bound to [\.0-9]+ -- renewal in [0-9]+ seconds\.$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhclient(-2.2.x)?: irda0: unknown hardware address type 783$ diff --git a/logcheck/ignore.d.server/dhcp.changes b/logcheck/ignore.d.server/dhcp.changes index 3980d63..b4fb547 100644 --- a/logcheck/ignore.d.server/dhcp.changes +++ b/logcheck/ignore.d.server/dhcp.changes @@ -1,8 +1,8 @@ # NB: dhcp3 entries are in dhcp3-common -dhcpd-2.2.x: Abandoning IP address [\.0-9]+: (declined\.|pinged before offer) ?$ -dhcpd-2.2.x: BOOT(DISCOVER|REQUEST) from [0-9a-f:]+ via eth[0-9]+ (\(non-rfc1048)\) ?$ -dhcpd-2.2.x: BOOTREPLY for [\.0-9]+ to [^[:space:]]+ \([0-9a-f:]+\) via eth[0-9]+ ?$ -dhcpd-2.2.x: DHCP(ACK|NAK|OFFER) on [\.0-9]+ to [0-9a-f:]+ via eth[0-9]+ ?$ -dhcpd-2.2.x: DHCP(DECLINE on|RELEASE of|REQUEST for) [\.0-9]+ from [0-9a-f:]+( \([^[:space:]]+\))? via eth[0-9]+ \((not )?found\) ?$ -dhcpd-2.2.x: DHCPINFORM from [\.0-9]+ ?$ -dhcpd-2.2.x: DHCPREQUEST for [\.0-9]+ from [0-9a-f:]+( \([^[:space:]]+\))? via eth[0-9]+: wrong network\. ?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd-2.2.x: Abandoning IP address [\.0-9]+: (declined\.|pinged before offer) ?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd-2.2.x: BOOT(DISCOVER|REQUEST) from [0-9a-f:]+ via eth[0-9]+ (\(non-rfc1048)\) ?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd-2.2.x: BOOTREPLY for [\.0-9]+ to [^[:space:]]+ \([0-9a-f:]+\) via eth[0-9]+ ?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd-2.2.x: DHCP(ACK|NAK|OFFER) on [\.0-9]+ to [0-9a-f:]+ via eth[0-9]+ ?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd-2.2.x: DHCP(DECLINE on|RELEASE of|REQUEST for) [\.0-9]+ from [0-9a-f:]+( \([^[:space:]]+\))? via eth[0-9]+ \((not )?found\) ?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd-2.2.x: DHCPINFORM from [\.0-9]+ ?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd-2.2.x: DHCPREQUEST for [\.0-9]+ from [0-9a-f:]+( \([^[:space:]]+\))? via eth[0-9]+: wrong network\. ?$ diff --git a/logcheck/ignore.d.server/dhcp3-common b/logcheck/ignore.d.server/dhcp3-common index 8ab9acc..2fce42f 100644 --- a/logcheck/ignore.d.server/dhcp3-common +++ b/logcheck/ignore.d.server/dhcp3-common @@ -1,12 +1,12 @@ -dhcpd: Abandoning IP address [\.0-9]+: pinged before offer ?$ -dhcpd: BOOTREQUEST from [0-9a-f:]+ ?$ -dhcpd: DHCP(ACK|NAK|OFFER) on [\.0-9]+ to [0-9a-f:]+( \([^\)]+\))? via eth[0-9]+ ?$ -dhcpd: DHCPACK to [\.0-9]+ ?$ -dhcpd: DHCPDISCOVER from [0-9a-f:]+( \([^\)]+\))? via eth[0-9]+ ?$ -dhcpd: DHCPINFORM from [\.0-9]+( via eth[0-9]+)? ?$ -dhcpd: DHCPRELEASE of [\.0-9]+( from [0-9a-f:]+( \([^\)]+\))? via eth[0-9]+( \(found\))?)? ?$ -dhcpd: DHCPREQUEST for [\.0-9]+( \([\.0-9]+\))? from [0-9a-f:]+( \([^\)]+\))? via eth[0-9]+(: (unknown lease [\.0-9]+|wrong network)\.)? ?$ -dhcpd: ICMP Echo reply while lease [\.0-9]+ valid. ?$ -dhcpd: Wrote [0-9]+ (leases|deleted host decls|new dynamic host decls) to leases file\. ?$ -dhcpd: accepting packet with data after udp payload. ?$ -dhcpd: ip length 576 disagrees with bytes received 590. ?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd: Abandoning IP address [\.0-9]+: pinged before offer ?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd: BOOTREQUEST from [0-9a-f:]+ ?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd: DHCP(ACK|NAK|OFFER) on [\.0-9]+ to [0-9a-f:]+( \([^\)]+\))? via eth[0-9]+ ?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd: DHCPACK to [\.0-9]+ ?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd: DHCPDISCOVER from [0-9a-f:]+( \([^\)]+\))? via eth[0-9]+ ?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd: DHCPINFORM from [\.0-9]+( via eth[0-9]+)? ?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd: DHCPRELEASE of [\.0-9]+( from [0-9a-f:]+( \([^\)]+\))? via eth[0-9]+( \(found\))?)? ?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd: DHCPREQUEST for [\.0-9]+( \([\.0-9]+\))? from [0-9a-f:]+( \([^\)]+\))? via eth[0-9]+(: (unknown lease [\.0-9]+|wrong network)\.)? ?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd: ICMP Echo reply while lease [\.0-9]+ valid. ?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd: Wrote [0-9]+ (leases|deleted host decls|new dynamic host decls) to leases file\. ?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd: accepting packet with data after udp payload. ?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd: ip length 576 disagrees with bytes received 590. ?$ diff --git a/logcheck/ignore.d.server/gdm b/logcheck/ignore.d.server/gdm index 79229c6..2fd4342 100644 --- a/logcheck/ignore.d.server/gdm +++ b/logcheck/ignore.d.server/gdm @@ -1 +1 @@ -gdm\[[0-9]+\]: run_pictures: Directory [^[:space:]] does not exist\.$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ gdm\[[0-9]+\]: run_pictures: Directory [^[:space:]] does not exist\.$ diff --git a/logcheck/ignore.d.server/gdm.da_DK b/logcheck/ignore.d.server/gdm.da_DK index 56b564a..cf63c5c 100644 --- a/logcheck/ignore.d.server/gdm.da_DK +++ b/logcheck/ignore.d.server/gdm.da_DK @@ -1,4 +1,4 @@ -gdm\[[0-9]+\]: Pingning af.* mislykkedes, deaktiver terminal! -gdm\[[0-9]+\]: \(child [0-9]+\) gdm_slave_xioerror_handler: Fatal X-fejl - genstarter [0-9:\.]*$ -gdm\[[0-9]+\]: run_pictures: /usr/share/pixmaps er ikke ejet af uid [^[:space:]]\.$ -gdm\[[0-9]+\]: run_pictures: Mappen [^[:space:]] eksisterer ikke\.$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ gdm\[[0-9]+\]: Pingning af.* mislykkedes, deaktiver terminal! +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ gdm\[[0-9]+\]: \(child [0-9]+\) gdm_slave_xioerror_handler: Fatal X-fejl - genstarter [0-9:\.]*$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ gdm\[[0-9]+\]: run_pictures: /usr/share/pixmaps er ikke ejet af uid [^[:space:]]\.$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ gdm\[[0-9]+\]: run_pictures: Mappen [^[:space:]] eksisterer ikke\.$ diff --git a/logcheck/ignore.d.server/hotplug b/logcheck/ignore.d.server/hotplug index 6dd646c..6dc05f1 100644 --- a/logcheck/ignore.d.server/hotplug +++ b/logcheck/ignore.d.server/hotplug @@ -1,4 +1,4 @@ -/etc/hotplug/net.agent: assuming ppp[0-9] is already up$ -/etc/hotplug/net.agent: invoke if(up|down) ppp[0-9]$ -/etc/hotplug/usb.agent: Setup [^[:space:]]+ for USB product [0-9a-f/]+$ -modprobe: modprobe: Can't locate module (keybdev|mousedev|usbcore)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ /etc/hotplug/net.agent: assuming ppp[0-9] is already up$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ /etc/hotplug/net.agent: invoke if(up|down) ppp[0-9]$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ /etc/hotplug/usb.agent: Setup [^[:space:]]+ for USB product [0-9a-f/]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ modprobe: modprobe: Can't locate module (keybdev|mousedev|usbcore)$ diff --git a/logcheck/ignore.d.server/hylafax-server b/logcheck/ignore.d.server/hylafax-server index dedf0fa..2e6f7a9 100644 --- a/logcheck/ignore.d.server/hylafax-server +++ b/logcheck/ignore.d.server/hylafax-server @@ -1,10 +1,10 @@ -Fax(Getty|Send)\[[0-9]+\]: STATE CHANGE:( ->| BASE| LOCKWAIT| LISTENING| RUNNING| ANSWERING| RECEIVING| MODEMWAIT)+$ -Fax(Getty|Send)\[[0-9]+\]: MODEM (ROCKWELL|ZYXEL) .*$ -FaxGetty\[[0-9]+\]: RECV FAX \([0-9]+\): from .*, page .* in [0-9]+:[0-9]+, INF, .* line/mm, (1|2)-D MR(, [0-9]+ bit/s)?$ -FaxGetty\[[0-9]+\]: RECV FAX \([0-9]+\): recvq/fax[0-9]+\.tif from .*, route to .*, [0-9]+ pages in [0-9]+:[0-9]+$ -FaxGetty\[[0-9]+\]: RECV FAX: bin/faxrcvd "recvq/fax[0-9]+\.tif" "ttyS[012]" "[0-9]+"( "")+$ -FaxGetty\[[0-9]+\]: ANSWER: Ring detected without successful handshake$ -FaxGetty\[[0-9]+\]: ANSWER: FAX CONNECTION DEVICE '[^[:blank:]']+'$ -FaxQueuer\[[0-9]+\]: SUBMIT JOB [0-9]+$ -FaxSend\[[0-9]+\]: SEND FAX: JOB [0-9]+ DEST [0-9]+ COMMID [0-9]+$ -HylaFAX\[[0-9]+\]: Filesystem has SysV-style file creation semantics.$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ Fax(Getty|Send)\[[0-9]+\]: STATE CHANGE:( ->| BASE| LOCKWAIT| LISTENING| RUNNING| ANSWERING| RECEIVING| MODEMWAIT)+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ Fax(Getty|Send)\[[0-9]+\]: MODEM (ROCKWELL|ZYXEL) .*$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ FaxGetty\[[0-9]+\]: RECV FAX \([0-9]+\): from .*, page .* in [0-9]+:[0-9]+, INF, .* line/mm, (1|2)-D MR(, [0-9]+ bit/s)?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ FaxGetty\[[0-9]+\]: RECV FAX \([0-9]+\): recvq/fax[0-9]+\.tif from .*, route to .*, [0-9]+ pages in [0-9]+:[0-9]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ FaxGetty\[[0-9]+\]: RECV FAX: bin/faxrcvd "recvq/fax[0-9]+\.tif" "ttyS[012]" "[0-9]+"( "")+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ FaxGetty\[[0-9]+\]: ANSWER: Ring detected without successful handshake$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ FaxGetty\[[0-9]+\]: ANSWER: FAX CONNECTION DEVICE '[^[:blank:]']+'$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ FaxQueuer\[[0-9]+\]: SUBMIT JOB [0-9]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ FaxSend\[[0-9]+\]: SEND FAX: JOB [0-9]+ DEST [0-9]+ COMMID [0-9]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ HylaFAX\[[0-9]+\]: Filesystem has SysV-style file creation semantics.$ diff --git a/logcheck/ignore.d.server/imp b/logcheck/ignore.d.server/imp index d4ce53b..1fb7a8d 100644 --- a/logcheck/ignore.d.server/imp +++ b/logcheck/ignore.d.server/imp @@ -1 +1 @@ -IMP\[[0-9]+\]: Login [0-9\.]+ to [^[:space:]]+ as [^[:space:]]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ IMP\[[0-9]+\]: Login [0-9\.]+ to [^[:space:]]+ as [^[:space:]]+$ diff --git a/logcheck/ignore.d.server/libgpmg1 b/logcheck/ignore.d.server/libgpmg1 index b7450d7..d6a3da2 100644 --- a/logcheck/ignore.d.server/libgpmg1 +++ b/logcheck/ignore.d.server/libgpmg1 @@ -1 +1 @@ -[[:alnum:]]+: /dev/gpmctl: No such file or directory$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ [[:alnum:]]+: /dev/gpmctl: No such file or directory$ diff --git a/logcheck/ignore.d.server/libgpmg1.da_DK b/logcheck/ignore.d.server/libgpmg1.da_DK index e14d4cd..89db7bd 100644 --- a/logcheck/ignore.d.server/libgpmg1.da_DK +++ b/logcheck/ignore.d.server/libgpmg1.da_DK @@ -1 +1 @@ -[[:alnum:]]+: /dev/gpmctl: Ingen sådan fil eller filkatalog$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ [[:alnum:]]+: /dev/gpmctl: Ingen sådan fil eller filkatalog$ diff --git a/logcheck/ignore.d.server/libpam-modules b/logcheck/ignore.d.server/libpam-modules index 89f4972..1764610 100644 --- a/logcheck/ignore.d.server/libpam-modules +++ b/logcheck/ignore.d.server/libpam-modules @@ -1 +1 @@ -pam_limits\[[0-9]+\]: default limits skipped for 'root'$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pam_limits\[[0-9]+\]: default limits skipped for 'root'$ diff --git a/logcheck/ignore.d.server/local b/logcheck/ignore.d.server/local index a1d30e3..34ab534 100644 --- a/logcheck/ignore.d.server/local +++ b/logcheck/ignore.d.server/local @@ -1,434 +1,434 @@ ### ignore.d.server/amanda -amandad\[[0-9]+\]: connect from +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ amandad\[[0-9]+\]: connect from ### ignore.d.server/amavis -amavis\[[0-9]+\]: cached [a-f0-9]+ from <[^[:space:]]*>$ -amavis\[[0-9]+\]: infected \([^[:space:]]+\), from=<[^[:space:]]+>, to=<[^[:space:]]+>, quarantine virus-[0-9-]+$ -amavis\[[0-9]+\]: local delivery: <[^[:space:]]*> -> <(spam|virus)-quarantine>, mbx=/var/lib/amavis/virusmails/(spam|virus)-[[:alnum:]-]+(\.gz)?$ -amavis\[[0-9]+\]: mail checking ended: (DISCARD|REJECT)$ -amavis\[[0-9]+\]: spam from=(<[^>]+>|\(\?\)), to=(<[^>]+>,)+ quarantine spam-[0-9a-f-]+$ -amavis\[[0-9]+\]: spam_scan: (No|Yes), hits=[\.0-9-]+ tests=[,_A-Z0-9]+ <[^>]*>$ -amavis\[[0-9]+\]: spam_scan: whitelisted sender <[^[:space:]]+>, spam check skipped$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ amavis\[[0-9]+\]: cached [a-f0-9]+ from <[^[:space:]]*>$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ amavis\[[0-9]+\]: infected \([^[:space:]]+\), from=<[^[:space:]]+>, to=<[^[:space:]]+>, quarantine virus-[0-9-]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ amavis\[[0-9]+\]: local delivery: <[^[:space:]]*> -> <(spam|virus)-quarantine>, mbx=/var/lib/amavis/virusmails/(spam|virus)-[[:alnum:]-]+(\.gz)?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ amavis\[[0-9]+\]: mail checking ended: (DISCARD|REJECT)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ amavis\[[0-9]+\]: spam from=(<[^>]+>|\(\?\)), to=(<[^>]+>,)+ quarantine spam-[0-9a-f-]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ amavis\[[0-9]+\]: spam_scan: (No|Yes), hits=[\.0-9-]+ tests=[,_A-Z0-9]+ <[^>]*>$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ amavis\[[0-9]+\]: spam_scan: whitelisted sender <[^[:space:]]+>, spam check skipped$ ### ignore.d.server/anacron -/USR/SBIN/CRON\[[0-9]+\]: \(root\) CMD \(test -e /usr/sbin/anacron || run-parts --report /etc/cron.(daily|weekly|monthly)\) $ -anacron\[[0-9]+\]: Anacron 2.3 started on [0-9-]+$ -anacron\[[0-9]+\]: Job `cron.(daily|weekly|monthly)' started$ -anacron\[[0-9]+\]: Job `cron.(daily|weekly|monthly)' terminated( \(exit status: 1\))?( \(mailing output\))?$ -anacron\[[0-9]+\]: Jobs will be executed sequentially$ -anacron\[[0-9]+\]: Normal exit \([0-9]+ jobs run\)$ -anacron\[[0-9]+\]: Updated timestamp for job `cron.(daily|weekly|monthly)' to [0-9-]+$ -anacron\[[0-9]+\]: Will run job `cron.(daily|weekly|monthly)' in (5|10|15) min\.$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ /USR/SBIN/CRON\[[0-9]+\]: \(root\) CMD \(test -e /usr/sbin/anacron || run-parts --report /etc/cron.(daily|weekly|monthly)\) $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ anacron\[[0-9]+\]: Anacron 2.3 started on [0-9-]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ anacron\[[0-9]+\]: Job `cron.(daily|weekly|monthly)' started$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ anacron\[[0-9]+\]: Job `cron.(daily|weekly|monthly)' terminated( \(exit status: 1\))?( \(mailing output\))?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ anacron\[[0-9]+\]: Jobs will be executed sequentially$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ anacron\[[0-9]+\]: Normal exit \([0-9]+ jobs run\)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ anacron\[[0-9]+\]: Updated timestamp for job `cron.(daily|weekly|monthly)' to [0-9-]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ anacron\[[0-9]+\]: Will run job `cron.(daily|weekly|monthly)' in (5|10|15) min\.$ ### ignore.d.server/bind.changes -named\[[0-9]+\]: Lame delegation -named\[[0-9]+\]: Lame server on '[^[:space:]]+' \(in '[^[:space:]]+'\?\): \[[\.0-9]+\]\.[0-9]+ '[^[:space:]]+'$ -named\[[0-9]+\]: Response from -named\[[0-9]+\]: reloading -named\[[0-9]+\]: Cleaned cache of [0-9]+ RRsets$ -named\[[0-9]+\]: Sent NOTIFY for [^[:space:]]+$ -named\[[0-9]+\]: approved AXFR from [^[:space:]]+ for [^[:space:]]+$ -named\[[0-9]+\]: zone transfer \(AXFR\) of [^[:space:]]+ to [^[:space:]]+$ -named\[[0-9]+\]: suppressing duplicate notify$ -named\[[0-9]+\]: USAGE [0-9]+ [0-9]+ CPU=[\.0-9]+u/[\.0-9]+s CHILDCPU=[\.0-9]+u/[\.0-9]+s$ -named\[[0-9]+\]: NSTATS [0-9]+ [0-9]+( (38|A|AAAA|ANY|AXFR|CNAME|IXFR|MX|NS|PTR|SOA|TXT)=[0-9]+)*$ -named\[[0-9]+\]: XSTATS [0-9]+ [0-9]+( (RR|RNXD|RFwdR|RDupR|RFail|RFErr|RErr|RAXFR|RLame|ROpts|SSysQ|SAns|SFwdQ|SDupQ|SErr|RQ|RIQ|RFwdQ|RDupQ|RTCP|SFwdR|SFail|SFErr|SNaAns|SNXD|RUQ|RURQ|RUXFR|RUUpd)=[0-9]+)*$ -named\[[0-9]+\]: lame server resolving '[^[:space:]]+' \(in '[^[:space:]]+'\?\): [\.0-9.]+#[0-9]+$ -named\[[0-9]+\]: Received NOTIFY answer -named\[[0-9]+\]: (master |slave )?zone "[^[:space:]]+" \(IN\) loaded \(serial [0-9]+\)$ -named\[[0-9]+\]: (ns_forw|ns_resp|sysquery): query\([^[:space:]]+\) (NS points to CNAME \([^[:space:]]+\)|No possible A RRs|All possible A RR's lame|Bogus LOOPBACK A RR \([^[:space:]]+\))( learnt \([^[:space:]]+\))?$ -named\[[0-9]+\]: client [\.0-9.]+#[0-9]+: transfer of '[^[:space:]]+/IN': AXFR(-style IXFR)? started$ -named\[[0-9]+\]: zone [^[:space:]]+: transfered serial [0-9]+$ -named\[[0-9]+\]: transfer of '[^[:space:]]+' from [^[:space:]]+: end of transfer$ -named\[[0-9]+\]: zone [^[:space:]]+/IN: sending notifies \(serial [0-9]+\)$ -named\[[0-9]+\]: rcvd NOTIFY\([^[:space:]]+, IN, SOA\) from \[[\.0-9]+\]\.[0-9]+$ -named\[[0-9]+\]: late CNAME in answer section for [^[:space:]]+$ -named\[[0-9]+\]: unrelated additional info '[^[:space:]]+' type A from \[[\.0-9]+\]\.[0-9]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: Lame delegation +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: Lame server on '[^[:space:]]+' \(in '[^[:space:]]+'\?\): \[[\.0-9]+\]\.[0-9]+ '[^[:space:]]+'$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: Response from +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: reloading +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: Cleaned cache of [0-9]+ RRsets$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: Sent NOTIFY for [^[:space:]]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: approved AXFR from [^[:space:]]+ for [^[:space:]]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: zone transfer \(AXFR\) of [^[:space:]]+ to [^[:space:]]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: suppressing duplicate notify$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: USAGE [0-9]+ [0-9]+ CPU=[\.0-9]+u/[\.0-9]+s CHILDCPU=[\.0-9]+u/[\.0-9]+s$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: NSTATS [0-9]+ [0-9]+( (38|A|AAAA|ANY|AXFR|CNAME|IXFR|MX|NS|PTR|SOA|TXT)=[0-9]+)*$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: XSTATS [0-9]+ [0-9]+( (RR|RNXD|RFwdR|RDupR|RFail|RFErr|RErr|RAXFR|RLame|ROpts|SSysQ|SAns|SFwdQ|SDupQ|SErr|RQ|RIQ|RFwdQ|RDupQ|RTCP|SFwdR|SFail|SFErr|SNaAns|SNXD|RUQ|RURQ|RUXFR|RUUpd)=[0-9]+)*$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: lame server resolving '[^[:space:]]+' \(in '[^[:space:]]+'\?\): [\.0-9.]+#[0-9]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: Received NOTIFY answer +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: (master |slave )?zone "[^[:space:]]+" \(IN\) loaded \(serial [0-9]+\)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: (ns_forw|ns_resp|sysquery): query\([^[:space:]]+\) (NS points to CNAME \([^[:space:]]+\)|No possible A RRs|All possible A RR's lame|Bogus LOOPBACK A RR \([^[:space:]]+\))( learnt \([^[:space:]]+\))?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: client [\.0-9.]+#[0-9]+: transfer of '[^[:space:]]+/IN': AXFR(-style IXFR)? started$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: zone [^[:space:]]+: transfered serial [0-9]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: transfer of '[^[:space:]]+' from [^[:space:]]+: end of transfer$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: zone [^[:space:]]+/IN: sending notifies \(serial [0-9]+\)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: rcvd NOTIFY\([^[:space:]]+, IN, SOA\) from \[[\.0-9]+\]\.[0-9]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: late CNAME in answer section for [^[:space:]]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: unrelated additional info '[^[:space:]]+' type A from \[[\.0-9]+\]\.[0-9]+$ ### ignore.d.server/bind.tmp -named\[[0-9]+\]: zone .*: refresh: failure trying master .*: timed out$ -named\[[0-9]+\]: client [\.0-9]+#[0-9]+: update forwarding denied$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: zone .*: refresh: failure trying master .*: timed out$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: client [\.0-9]+#[0-9]+: update forwarding denied$ ### ignore.d.server/courier -courierpop3login: Connection, ip=\[::ffff:.*\] -courierpop3login: LOGIN, user=.*, ip=\[::ffff:.*\] -courierpop3login: LOGOUT, user=.*, ip=\[::ffff:.*\], top=.* retr=.* -courierpop3login: Disconnected, ip=\[::ffff:.*\] -courierpop3login: TIMEOUT, user=.*, ip=\[::ffff:.*\], top=0, retr=0 -pop3d-ssl: Connection, ip=\[::ffff:.*\] -pop3d-ssl: LOGIN, user=.*, ip=\[::ffff:.*\] -pop3d-ssl: LOGOUT, user=.*, ip=\[::ffff:.*\], top=.*, retr=.* -pop3d-ssl: TIMEOUT, user=.*, ip=\[::ffff:.*\],top=.*, retr=.* -imaplogin: Connection, ip=\[::ffff:.*\] -imaplogin: LOGIN, user=.*, ip=\[::ffff:.*\] -imaplogin: LOGOUT, user=.*, ip=\[::ffff:.*\], headers=.* body=.* -imaplogin: DISCONNECTED, user=.*, ip=\[::ffff:.*\].* -imapd-ssl: LOGOUT, user=.*, ip=\[::ffff:.*\], headers=.* body=.* -imapd-ssl: Connection, ip=\[::ffff:.*\] -imapd-ssl: LOGIN, user=.*, ip=\[::ffff:.*\] -imapd-ssl: DISCONNECTED, user=.*, ip=\[::ffff:.*\] +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ courierpop3login: Connection, ip=\[::ffff:.*\] +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ courierpop3login: LOGIN, user=.*, ip=\[::ffff:.*\] +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ courierpop3login: LOGOUT, user=.*, ip=\[::ffff:.*\], top=.* retr=.* +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ courierpop3login: Disconnected, ip=\[::ffff:.*\] +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ courierpop3login: TIMEOUT, user=.*, ip=\[::ffff:.*\], top=0, retr=0 +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pop3d-ssl: Connection, ip=\[::ffff:.*\] +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pop3d-ssl: LOGIN, user=.*, ip=\[::ffff:.*\] +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pop3d-ssl: LOGOUT, user=.*, ip=\[::ffff:.*\], top=.*, retr=.* +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pop3d-ssl: TIMEOUT, user=.*, ip=\[::ffff:.*\],top=.*, retr=.* +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ imaplogin: Connection, ip=\[::ffff:.*\] +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ imaplogin: LOGIN, user=.*, ip=\[::ffff:.*\] +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ imaplogin: LOGOUT, user=.*, ip=\[::ffff:.*\], headers=.* body=.* +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ imaplogin: DISCONNECTED, user=.*, ip=\[::ffff:.*\].* +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ imapd-ssl: LOGOUT, user=.*, ip=\[::ffff:.*\], headers=.* body=.* +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ imapd-ssl: Connection, ip=\[::ffff:.*\] +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ imapd-ssl: LOGIN, user=.*, ip=\[::ffff:.*\] +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ imapd-ssl: DISCONNECTED, user=.*, ip=\[::ffff:.*\] ### ignore.d.server/dancer-ircd -ircd\[[0-9]+\]: ircd exiting: autodie$ -ircd\[[0-9]+\]: Server Ready$ -(ircd\[[0-9]+\]: )?binding stream socket [\.[:alnum:]]+\[\*\.666[789]\]: Address already in use$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ircd\[[0-9]+\]: ircd exiting: autodie$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ircd\[[0-9]+\]: Server Ready$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ (ircd\[[0-9]+\]: )?binding stream socket [\.[:alnum:]]+\[\*\.666[789]\]: Address already in use$ ### ignore.d.server/dhcp-client # NB: dhcp 2-x entries are in dhcp -dhclient(-2.2.x)?: DHCP(REQUEST|DISCOVER) on [^[:space:]]+ to [\.0-9]+ port 67( interval [0-9]+)?$ -dhclient(-2.2.x)?: DHCP(ACK|OFFER) from [\.0-9]+$ -dhclient(-2.2.x)?: bound to [\.0-9]+ -- renewal in [0-9]+ seconds\.$ -dhclient(-2.2.x)?: irda0: unknown hardware address type 783$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhclient(-2.2.x)?: DHCP(REQUEST|DISCOVER) on [^[:space:]]+ to [\.0-9]+ port 67( interval [0-9]+)?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhclient(-2.2.x)?: DHCP(ACK|OFFER) from [\.0-9]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhclient(-2.2.x)?: bound to [\.0-9]+ -- renewal in [0-9]+ seconds\.$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhclient(-2.2.x)?: irda0: unknown hardware address type 783$ ### ignore.d.server/dhcp3-common -dhcpd: Abandoning IP address [\.0-9]+: pinged before offer ?$ -dhcpd: BOOTREQUEST from [0-9a-f:]+ ?$ -dhcpd: DHCP(ACK|NAK|OFFER) on [\.0-9]+ to [0-9a-f:]+( \([^\)]+\))? via eth[0-9]+ ?$ -dhcpd: DHCPACK to [\.0-9]+ ?$ -dhcpd: DHCPDISCOVER from [0-9a-f:]+( \([^\)]+\))? via eth[0-9]+ ?$ -dhcpd: DHCPINFORM from [\.0-9]+( via eth[0-9]+)? ?$ -dhcpd: DHCPRELEASE of [\.0-9]+( from [0-9a-f:]+( \([^\)]+\))? via eth[0-9]+( \(found\))?)? ?$ -dhcpd: DHCPREQUEST for [\.0-9]+( \([\.0-9]+\))? from [0-9a-f:]+( \([^\)]+\))? via eth[0-9]+(: (unknown lease [\.0-9]+|wrong network)\.)? ?$ -dhcpd: ICMP Echo reply while lease [\.0-9]+ valid. ?$ -dhcpd: Wrote [0-9]+ (leases|deleted host decls|new dynamic host decls) to leases file\. ?$ -dhcpd: accepting packet with data after udp payload. ?$ -dhcpd: ip length 576 disagrees with bytes received 590. ?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd: Abandoning IP address [\.0-9]+: pinged before offer ?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd: BOOTREQUEST from [0-9a-f:]+ ?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd: DHCP(ACK|NAK|OFFER) on [\.0-9]+ to [0-9a-f:]+( \([^\)]+\))? via eth[0-9]+ ?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd: DHCPACK to [\.0-9]+ ?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd: DHCPDISCOVER from [0-9a-f:]+( \([^\)]+\))? via eth[0-9]+ ?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd: DHCPINFORM from [\.0-9]+( via eth[0-9]+)? ?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd: DHCPRELEASE of [\.0-9]+( from [0-9a-f:]+( \([^\)]+\))? via eth[0-9]+( \(found\))?)? ?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd: DHCPREQUEST for [\.0-9]+( \([\.0-9]+\))? from [0-9a-f:]+( \([^\)]+\))? via eth[0-9]+(: (unknown lease [\.0-9]+|wrong network)\.)? ?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd: ICMP Echo reply while lease [\.0-9]+ valid. ?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd: Wrote [0-9]+ (leases|deleted host decls|new dynamic host decls) to leases file\. ?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd: accepting packet with data after udp payload. ?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd: ip length 576 disagrees with bytes received 590. ?$ ### ignore.d.server/dhcp.changes # NB: dhcp3 entries are in dhcp3-common -dhcpd-2.2.x: Abandoning IP address [\.0-9]+: (declined\.|pinged before offer) ?$ -dhcpd-2.2.x: BOOT(DISCOVER|REQUEST) from [0-9a-f:]+ via eth[0-9]+ (\(non-rfc1048)\) ?$ -dhcpd-2.2.x: BOOTREPLY for [\.0-9]+ to [^[:space:]]+ \([0-9a-f:]+\) via eth[0-9]+ ?$ -dhcpd-2.2.x: DHCP(ACK|NAK|OFFER) on [\.0-9]+ to [0-9a-f:]+ via eth[0-9]+ ?$ -dhcpd-2.2.x: DHCP(DECLINE on|RELEASE of|REQUEST for) [\.0-9]+ from [0-9a-f:]+( \([^[:space:]]+\))? via eth[0-9]+ \((not )?found\) ?$ -dhcpd-2.2.x: DHCPINFORM from [\.0-9]+ ?$ -dhcpd-2.2.x: DHCPREQUEST for [\.0-9]+ from [0-9a-f:]+( \([^[:space:]]+\))? via eth[0-9]+: wrong network\. ?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd-2.2.x: Abandoning IP address [\.0-9]+: (declined\.|pinged before offer) ?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd-2.2.x: BOOT(DISCOVER|REQUEST) from [0-9a-f:]+ via eth[0-9]+ (\(non-rfc1048)\) ?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd-2.2.x: BOOTREPLY for [\.0-9]+ to [^[:space:]]+ \([0-9a-f:]+\) via eth[0-9]+ ?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd-2.2.x: DHCP(ACK|NAK|OFFER) on [\.0-9]+ to [0-9a-f:]+ via eth[0-9]+ ?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd-2.2.x: DHCP(DECLINE on|RELEASE of|REQUEST for) [\.0-9]+ from [0-9a-f:]+( \([^[:space:]]+\))? via eth[0-9]+ \((not )?found\) ?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd-2.2.x: DHCPINFORM from [\.0-9]+ ?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd-2.2.x: DHCPREQUEST for [\.0-9]+ from [0-9a-f:]+( \([^[:space:]]+\))? via eth[0-9]+: wrong network\. ?$ ### ignore.d.server/gdm -gdm\[[0-9]+\]: run_pictures: Directory [^[:space:]] does not exist\.$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ gdm\[[0-9]+\]: run_pictures: Directory [^[:space:]] does not exist\.$ ### ignore.d.server/gdm.da_DK -gdm\[[0-9]+\]: Pingning af.* mislykkedes, deaktiver terminal! -gdm\[[0-9]+\]: \(child [0-9]+\) gdm_slave_xioerror_handler: Fatal X-fejl - genstarter [0-9:\.]*$ -gdm\[[0-9]+\]: run_pictures: /usr/share/pixmaps er ikke ejet af uid [^[:space:]]\.$ -gdm\[[0-9]+\]: run_pictures: Mappen [^[:space:]] eksisterer ikke\.$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ gdm\[[0-9]+\]: Pingning af.* mislykkedes, deaktiver terminal! +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ gdm\[[0-9]+\]: \(child [0-9]+\) gdm_slave_xioerror_handler: Fatal X-fejl - genstarter [0-9:\.]*$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ gdm\[[0-9]+\]: run_pictures: /usr/share/pixmaps er ikke ejet af uid [^[:space:]]\.$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ gdm\[[0-9]+\]: run_pictures: Mappen [^[:space:]] eksisterer ikke\.$ ### ignore.d.server/hotplug -/etc/hotplug/net.agent: assuming ppp[0-9] is already up$ -/etc/hotplug/net.agent: invoke if(up|down) ppp[0-9]$ -/etc/hotplug/usb.agent: Setup [^[:space:]]+ for USB product [0-9a-f/]+$ -modprobe: modprobe: Can't locate module (keybdev|mousedev|usbcore)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ /etc/hotplug/net.agent: assuming ppp[0-9] is already up$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ /etc/hotplug/net.agent: invoke if(up|down) ppp[0-9]$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ /etc/hotplug/usb.agent: Setup [^[:space:]]+ for USB product [0-9a-f/]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ modprobe: modprobe: Can't locate module (keybdev|mousedev|usbcore)$ ### ignore.d.server/hylafax-server -Fax(Getty|Send)\[[0-9]+\]: STATE CHANGE:( ->| BASE| LOCKWAIT| LISTENING| RUNNING| ANSWERING| RECEIVING| MODEMWAIT)+$ -Fax(Getty|Send)\[[0-9]+\]: MODEM (ROCKWELL|ZYXEL) .*$ -FaxGetty\[[0-9]+\]: RECV FAX \([0-9]+\): from .*, page .* in [0-9]+:[0-9]+, INF, .* line/mm, (1|2)-D MR(, [0-9]+ bit/s)?$ -FaxGetty\[[0-9]+\]: RECV FAX \([0-9]+\): recvq/fax[0-9]+\.tif from .*, route to .*, [0-9]+ pages in [0-9]+:[0-9]+$ -FaxGetty\[[0-9]+\]: RECV FAX: bin/faxrcvd "recvq/fax[0-9]+\.tif" "ttyS[012]" "[0-9]+"( "")+$ -FaxGetty\[[0-9]+\]: ANSWER: Ring detected without successful handshake$ -FaxGetty\[[0-9]+\]: ANSWER: FAX CONNECTION DEVICE '[^[:blank:]']+'$ -FaxQueuer\[[0-9]+\]: SUBMIT JOB [0-9]+$ -FaxSend\[[0-9]+\]: SEND FAX: JOB [0-9]+ DEST [0-9]+ COMMID [0-9]+$ -HylaFAX\[[0-9]+\]: Filesystem has SysV-style file creation semantics.$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ Fax(Getty|Send)\[[0-9]+\]: STATE CHANGE:( ->| BASE| LOCKWAIT| LISTENING| RUNNING| ANSWERING| RECEIVING| MODEMWAIT)+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ Fax(Getty|Send)\[[0-9]+\]: MODEM (ROCKWELL|ZYXEL) .*$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ FaxGetty\[[0-9]+\]: RECV FAX \([0-9]+\): from .*, page .* in [0-9]+:[0-9]+, INF, .* line/mm, (1|2)-D MR(, [0-9]+ bit/s)?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ FaxGetty\[[0-9]+\]: RECV FAX \([0-9]+\): recvq/fax[0-9]+\.tif from .*, route to .*, [0-9]+ pages in [0-9]+:[0-9]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ FaxGetty\[[0-9]+\]: RECV FAX: bin/faxrcvd "recvq/fax[0-9]+\.tif" "ttyS[012]" "[0-9]+"( "")+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ FaxGetty\[[0-9]+\]: ANSWER: Ring detected without successful handshake$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ FaxGetty\[[0-9]+\]: ANSWER: FAX CONNECTION DEVICE '[^[:blank:]']+'$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ FaxQueuer\[[0-9]+\]: SUBMIT JOB [0-9]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ FaxSend\[[0-9]+\]: SEND FAX: JOB [0-9]+ DEST [0-9]+ COMMID [0-9]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ HylaFAX\[[0-9]+\]: Filesystem has SysV-style file creation semantics.$ ### ignore.d.server/imp -IMP\[[0-9]+\]: Login [0-9\.]+ to [^[:space:]]+ as [^[:space:]]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ IMP\[[0-9]+\]: Login [0-9\.]+ to [^[:space:]]+ as [^[:space:]]+$ ### ignore.d.server/libgpmg1 -[[:alnum:]]+: /dev/gpmctl: No such file or directory$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ [[:alnum:]]+: /dev/gpmctl: No such file or directory$ ### ignore.d.server/libgpmg1.da_DK -[[:alnum:]]+: /dev/gpmctl: Ingen sådan fil eller filkatalog$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ [[:alnum:]]+: /dev/gpmctl: Ingen sådan fil eller filkatalog$ ### ignore.d.server/libpam-modules -pam_limits\[[0-9]+\]: default limits skipped for 'root'$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pam_limits\[[0-9]+\]: default limits skipped for 'root'$ ### ignore.d.server/mailutils-imap4d -gnu-imap4d\[[0-9]+\]: Incoming connection opened$ -gnu-imap4d\[[0-9]+\]: connect from [\.0-9]+$ -gnu-imap4d\[[0-9]+\]: User '[[:alnum:]]+' logged in$ -gnu-imap4d\[[0-9]+\]: Session timed out for user: [[:alnum:]]+$ -gnu-imap4d\[[0-9]+\]: got signal Alarm clock$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ gnu-imap4d\[[0-9]+\]: Incoming connection opened$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ gnu-imap4d\[[0-9]+\]: connect from [\.0-9]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ gnu-imap4d\[[0-9]+\]: User '[[:alnum:]]+' logged in$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ gnu-imap4d\[[0-9]+\]: Session timed out for user: [[:alnum:]]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ gnu-imap4d\[[0-9]+\]: got signal Alarm clock$ ### ignore.d.server/misc # Figure out if these belong to dhcp or dhcp3-common (or dhclient?) -dhcpd.*: Reclaiming( REQUESTed) abandoned IP address [\.0-9]+ -dhcpd.*: already acking lease -dhcpd.*: send_packet: Connection refused -dhcpd.*: fallback_discard: Connection refused +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd.*: Reclaiming( REQUESTed) abandoned IP address [\.0-9]+ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd.*: already acking lease +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd.*: send_packet: Connection refused +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd.*: fallback_discard: Connection refused # These show up when isdnutils is installed, but isn't strictly related to those packages -kernel: isdn_net: call from [,0-9]+ -> [0-9]+$ -kernel: isdn_net: Service-Indicator not [0-9], ignored$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: isdn_net: call from [,0-9]+ -> [0-9]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: isdn_net: Service-Indicator not [0-9], ignored$ # This one shows up with firewalls blocking SMB ports non-silently -kernel: Packet log: input DENY .*:(137|138) .*:(137|138) .*$ -kernel: Shorewall:net2all:DROP:.* (SPT|DPT)=(13[789]|445) .*$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: Packet log: input DENY .*:(137|138) .*:(137|138) .*$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: Shorewall:net2all:DROP:.* (SPT|DPT)=(13[789]|445) .*$ ### ignore.d.server/murasaki -murasaki\.usb\[[0-9]+\]: found depended module="[[:alnum:]]+"$ -murasaki\.(usb|net)\[[0-9]+\]: try expanding "\[net\]"$ -murasaki\.(usb|net)\[[0-9]+\]: dependent\(net\) is found$ -murasaki\.(usb|net)\[[0-9]+\]: net device is (added|removed|(un)?register(e)?d)$ -murasaki\.(usb|net)\[[0-9]+\]: Execuing "net" "(stop|start)"$ -murasaki\.(usb|net)\[[0-9]+\]: execute if(up|down) (eth|(i)?ppp|irda)[0-9]$ -murasaki\.usb\[[0-9]+\]: (MATCH\(audio\) -> match_flags:[[:alnum:]]+ )?vendor:[[:alnum:]]+ product:[[:alnum:]]+ Dclass:[[:alnum:]]+ Dsubclass:[[:alnum:]]+ Dprotocol:[[:alnum:]]+ Iclass:[[:alnum:]]+ Isubclass:[[:alnum:]]+ Iprotocol:[[:alnum:]]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ murasaki\.usb\[[0-9]+\]: found depended module="[[:alnum:]]+"$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ murasaki\.(usb|net)\[[0-9]+\]: try expanding "\[net\]"$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ murasaki\.(usb|net)\[[0-9]+\]: dependent\(net\) is found$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ murasaki\.(usb|net)\[[0-9]+\]: net device is (added|removed|(un)?register(e)?d)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ murasaki\.(usb|net)\[[0-9]+\]: Execuing "net" "(stop|start)"$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ murasaki\.(usb|net)\[[0-9]+\]: execute if(up|down) (eth|(i)?ppp|irda)[0-9]$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ murasaki\.usb\[[0-9]+\]: (MATCH\(audio\) -> match_flags:[[:alnum:]]+ )?vendor:[[:alnum:]]+ product:[[:alnum:]]+ Dclass:[[:alnum:]]+ Dsubclass:[[:alnum:]]+ Dprotocol:[[:alnum:]]+ Iclass:[[:alnum:]]+ Isubclass:[[:alnum:]]+ Iprotocol:[[:alnum:]]+$ ### ignore.d.server/nagios -nagios: Auto-save of retention data completed successfully\. $ -nagios: LOG ROTATION: DAILY $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ nagios: Auto-save of retention data completed successfully\. $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ nagios: LOG ROTATION: DAILY $ ### ignore.d.server/netatalk.changes # Lines with "[^[:space:]]+:" at the beginning are for netatalk 1.6.x or newer. -afpd\[[0-9]+\]: (atp_rresp|afp_die: asp_shutdown): Connection timed out$ -afpd\[[0-9]+\]: [^[:space:]]+: D5:AFPDaemon: Parsing volset [^[:space:]]+$ -afpd\[[0-9]+\]: [^[:space:]]+: D5:AFPDaemon: using codepage directory: /etc/netatalk/nls/maccode\.[\.a-z0-9-]+$ -afpd\[[0-9]+\]: [^[:space:]]+: E:AFPDaemon: afp_alarm: child timed out$ -afpd\[[0-9]+\]: [^[:space:]]+: E:Default: atp_rresp: Connection timed out$ -afpd\[[0-9]+\]: [^[:space:]]+: E:Default: dsi_stream_read\(-1\): Connection reset by peer$ -afpd\[[0-9]+\]: [^[:space:]]+: E:Default: dsi_stream_write: Broken pipe$ -afpd\[[0-9]+\]: [^[:space:]]+: I:AFPDaemon: (afp_flushfork|afp_read|getforkparms): (ad_refresh|of_find): (No such file or directory|No such process|Permission denied)$ -afpd\[[0-9]+\]: [^[:space:]]+: I:AFPDaemon: (registering [[:alnum:]]+ \(uid [0-9]+\) on [\.0-9]+ as|removed) /[^[:space:]]+/net[\.0-9]+node[0-9]+$ -afpd\[[0-9]+\]: [^[:space:]]+: I:AFPDaemon: Connection terminated$ -afpd\[[0-9]+\]: [^[:space:]]+: I:AFPDaemon: [\.[:alnum:]]+ read, [\.[:alnum:]]+ written$ -afpd\[[0-9]+\]: [^[:space:]]+: I:AFPDaemon: login [[:alnum:]]+ \(uid [0-9]+, gid [0-9]+\)( AFP2\.2)?$ -afpd\[[0-9]+\]: [^[:space:]]+: I:AFPDaemon: logout [[:alnum:]]+$ -afpd\[[0-9]+\]: [^[:space:]]+: I:AFPDaemon: session from [\.:0-9]+ on [\.:0-9]+$ -afpd\[[0-9]+\]: [^[:space:]]+: I:Default: (server_child\[[0-9]+\] [0-9]+ )?(done|exited 1)$ -afpd\[[0-9]+\]: [^[:space:]]+: I:Default: ASIP session:[0-9]+\([0-9]+\) from [\.:0-9]+\([0-9]+\)$ -afpd\[[0-9]+\]: [^[:space:]]+: I:Default: CNID DB initialized using Sleepycat Software: Berkeley DB( [\.0-9]+: \([^\(]+\))?$ -afpd\[[0-9]+\]: [^[:space:]]+: I:Default: asp_alrm: [0-9]+ timed out$ -afpd\[[0-9]+\]: [^[:space:]]+: I:UAMSDaemon: ((dhx|cleartext|randnum/rand2num) )?login: [[:alnum:]]+$ -afpd\[[0-9]+\]: [^[:space:]]+: I:UAMSDaemon: login noauth$ -afpd\[[0-9]+\]: [^[:space:]]+: I:UAMSDaemon: uams_dhx_pam.c :PAM: PAM (Auth OK!|Success -- Success)$ -afpd\[[0-9]+\]: [^[:space:]]+: S:Logger: can't open Logfile /var/log/netatalk.log$ -afpd\[[0-9]+\]: [_[:alnum:]]+(\(-?[0-9]+\))?: stat [^:]+: (No such file or directory|Permission denied)$ -afpd\[[0-9]+\]: dsi_stream_read\(0\): (No such file or directory|No such process|Permission denied)$ -afpd\[[0-9]+\]: dsi_stream_read\(0\): Success$ -afpd\[[0-9]+\]: error stat'ing /[^[:space:]]+/net[\.0-9]+node[0-9]+: No such file or directory$ -atalkd\[[0-9]+\]: (as_timer|nbp brrq) sendto [\.0-9]+( \([0-9]+\))?: Network is unreachable $ -atalkd\[[0-9]+\]: zip (ignoring gnireply|gnireply from [\.0-9]+ \([[:alnum:]]+ [[:alnum:]]+\)) $ -papd\[[0-9]+\]: [^[:space:]]+: I:PAPDaemon: child [0-9]+ done$ -papd\[[0-9]+\]: [^[:space:]]+: I:PAPDaemon: child [0-9]+ for "[^"]+" from [\.0-9]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: (atp_rresp|afp_die: asp_shutdown): Connection timed out$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: [^[:space:]]+: D5:AFPDaemon: Parsing volset [^[:space:]]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: [^[:space:]]+: D5:AFPDaemon: using codepage directory: /etc/netatalk/nls/maccode\.[\.a-z0-9-]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: [^[:space:]]+: E:AFPDaemon: afp_alarm: child timed out$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: [^[:space:]]+: E:Default: atp_rresp: Connection timed out$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: [^[:space:]]+: E:Default: dsi_stream_read\(-1\): Connection reset by peer$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: [^[:space:]]+: E:Default: dsi_stream_write: Broken pipe$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: [^[:space:]]+: I:AFPDaemon: (afp_flushfork|afp_read|getforkparms): (ad_refresh|of_find): (No such file or directory|No such process|Permission denied)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: [^[:space:]]+: I:AFPDaemon: (registering [[:alnum:]]+ \(uid [0-9]+\) on [\.0-9]+ as|removed) /[^[:space:]]+/net[\.0-9]+node[0-9]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: [^[:space:]]+: I:AFPDaemon: Connection terminated$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: [^[:space:]]+: I:AFPDaemon: [\.[:alnum:]]+ read, [\.[:alnum:]]+ written$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: [^[:space:]]+: I:AFPDaemon: login [[:alnum:]]+ \(uid [0-9]+, gid [0-9]+\)( AFP2\.2)?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: [^[:space:]]+: I:AFPDaemon: logout [[:alnum:]]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: [^[:space:]]+: I:AFPDaemon: session from [\.:0-9]+ on [\.:0-9]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: [^[:space:]]+: I:Default: (server_child\[[0-9]+\] [0-9]+ )?(done|exited 1)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: [^[:space:]]+: I:Default: ASIP session:[0-9]+\([0-9]+\) from [\.:0-9]+\([0-9]+\)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: [^[:space:]]+: I:Default: CNID DB initialized using Sleepycat Software: Berkeley DB( [\.0-9]+: \([^\(]+\))?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: [^[:space:]]+: I:Default: asp_alrm: [0-9]+ timed out$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: [^[:space:]]+: I:UAMSDaemon: ((dhx|cleartext|randnum/rand2num) )?login: [[:alnum:]]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: [^[:space:]]+: I:UAMSDaemon: login noauth$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: [^[:space:]]+: I:UAMSDaemon: uams_dhx_pam.c :PAM: PAM (Auth OK!|Success -- Success)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: [^[:space:]]+: S:Logger: can't open Logfile /var/log/netatalk.log$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: [_[:alnum:]]+(\(-?[0-9]+\))?: stat [^:]+: (No such file or directory|Permission denied)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: dsi_stream_read\(0\): (No such file or directory|No such process|Permission denied)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: dsi_stream_read\(0\): Success$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: error stat'ing /[^[:space:]]+/net[\.0-9]+node[0-9]+: No such file or directory$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ atalkd\[[0-9]+\]: (as_timer|nbp brrq) sendto [\.0-9]+( \([0-9]+\))?: Network is unreachable $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ atalkd\[[0-9]+\]: zip (ignoring gnireply|gnireply from [\.0-9]+ \([[:alnum:]]+ [[:alnum:]]+\)) $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ papd\[[0-9]+\]: [^[:space:]]+: I:PAPDaemon: child [0-9]+ done$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ papd\[[0-9]+\]: [^[:space:]]+: I:PAPDaemon: child [0-9]+ for "[^"]+" from [\.0-9]+$ ### ignore.d.server/netsaint -netsaint: (HOST|SERVICE) (ALERT|NOTIFICATION|FLAPPING ALERT): .*$ -netsaint: Auto-save of retention data completed successfully\. $ -netsaint: Caught SIGTERM, shutting down\.\.\. $ -netsaint: Entering active mode\.\.\. $ -netsaint: NetSaint [\.0-9]+ starting\.\.\. \(PID=[0-9]+\) $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ netsaint: (HOST|SERVICE) (ALERT|NOTIFICATION|FLAPPING ALERT): .*$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ netsaint: Auto-save of retention data completed successfully\. $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ netsaint: Caught SIGTERM, shutting down\.\.\. $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ netsaint: Entering active mode\.\.\. $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ netsaint: NetSaint [\.0-9]+ starting\.\.\. \(PID=[0-9]+\) $ ### ignore.d.server/nfs-kernel-server -mountd\[[0-9]+\]: NFS mount of /[^[:space:]]+ attempted from [\.0-9]+$ -mountd\[[0-9]+\]: /[^[:space:]]+ has been mounted by [\.0-9]+$ -rpc\.mountd: authenticated unmount request from [\.0-9]+:[0-9]+ for /[^[:space:]]+ \(/[^[:space:]\)]+\) $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ mountd\[[0-9]+\]: NFS mount of /[^[:space:]]+ attempted from [\.0-9]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ mountd\[[0-9]+\]: /[^[:space:]]+ has been mounted by [\.0-9]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ rpc\.mountd: authenticated unmount request from [\.0-9]+:[0-9]+ for /[^[:space:]]+ \(/[^[:space:]\)]+\) $ ### ignore.d.server/non-debian # These entries are for syslogd open for remote hosts # (and advertised through DHCP) # # HP printers -printer: peripheral low-power state$ -printer: paper out$ -printer: error cleared$ -printer: powered up$ -printer: ready to print$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ printer: peripheral low-power state$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ printer: paper out$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ printer: error cleared$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ printer: powered up$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ printer: ready to print$ # FloppyFW DHCP server -[0-9A-F]+ 400 DHCP SERVER Offered \| Offering: [\.0-9]+ To: [0-9A-F]+ By: [\.0-9]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ [0-9A-F]+ 400 DHCP SERVER Offered \| Offering: [\.0-9]+ To: [0-9A-F]+ By: [\.0-9]+$ ### ignore.d.server/ntp-simple.changes -ntpd\[[0-9]+\]: kern_enable is 1$ -ntpd\[[0-9]+\]: kernel time discipline status [0-9]+$ -ntpd\[[0-9]+\]: precision = [0-9]+ usec$ -ntpd\[[0-9]+\]: signal_no_reset: signal 13 had flags [0-9]+$ -ntpd\[[0-9]+\]: using kernel phase-lock loop [0-9]+$ -ntpd\[[0-9]+\]: ntpd [\.0-9]+ [a-zA-Z]+ [a-zA-Z]+ [0-9]+ [0-9:]+ UTC 200[2-9]+ \(2\)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: kern_enable is 1$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: kernel time discipline status [0-9]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: precision = [0-9]+ usec$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: signal_no_reset: signal 13 had flags [0-9]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: using kernel phase-lock loop [0-9]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: ntpd [\.0-9]+ [a-zA-Z]+ [a-zA-Z]+ [0-9]+ [0-9:]+ UTC 200[2-9]+ \(2\)$ ### ignore.d.server/pop-before-smtp -pop-before-smtp\[[0-9]+\]: (opening|closing) relay for [\.0-9]+( --- not in mynetworks)?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pop-before-smtp\[[0-9]+\]: (opening|closing) relay for [\.0-9]+( --- not in mynetworks)?$ ### ignore.d.server/postfix -postfix/[[:alnum:]]+\[[0-9]+\]: table has changed -- exiting$ -postfix/cleanup\[[0-9]+\]: [A-Z0-9]+: message-id=.*$ -postfix/cleanup\[[0-9]+\]: warning: premature end-of-input from cleanup socket while reading input attribute name$ -postfix/local\[[0-9]+\]: warning: unable to create lock file /var/mail/[[:alnum:]]+\.lock: Permission denied$ -postfix/master\[[0-9]+\]: reload configuration$ -postfix/n?qmgr\[[0-9]+\]: [A-Z0-9]+: from=<[^,]*>, status=expired, returned to sender$ -postfix/n?qmgr\[[0-9]+\]: [A-Z0-9]+: skipped, still being delivered$ -postfix/postfix-script: refreshing the Postfix mail system$ -postfix/smtp\[[0-9]+\]: Peer certi?ficate could not be verified$ -postfix/smtp\[[0-9]+\]: SSL_connect error to [^[:space:]]+: -1 -postfix/smtp\[[0-9]+\]: [A-Z0-9]+: enabling PIX \. workaround for [^[:space:]]+\[[\.0-9]+\]$ -postfix/smtp\[[0-9]+\]: [^[:space:]]+ status=deferred \(connect to [^[:space:]]+\[[\.0-9]+\]: (Connection refused|server refused mail service)\)$ -postfix/smtp\[[0-9]+\]: connect to [^[:space:]]+\[[\.0-9]+\]: (Connection (refused|reset by peer|timed out)|read timeout|server (refused mail service|dropped connection)|No route to host) \(port 25\)$ -postfix/smtp\[[0-9]+\]: setting up TLS connection to [^[:space:]]+$ -postfix/smtp\[[0-9]+\]: verify error:num=10:certificate has expired$ -postfix/smtp\[[0-9]+\]: warning: bad size limit "truncates" in EHLO reply from [^[:space:]]+$ -postfix/smtp\[[0-9]+\]: warning: host [^[:space:]]+\[[\.0-9]+\] (greeted me|replied to HELO/EHLO) with my own hostname [^[:space:]]+$ -postfix/smtp\[[0-9]+\]: warning: no MX host for [^[:space:]]+ has a valid A record$ -postfix/smtpd?\[[0-9]+\]: (Unv|V)erified: subject_CN=.*, issuer=.*$ -postfix/smtpd?\[[0-9]+\]: TLS connection established (from|to) [^[:space:]]+: (SSL|TLS)v[123] with cipher [^[:space:]]+ \([0-9/]+ bits\)$ -postfix/smtpd?\[[0-9]+\]: cert has expired$ -postfix/smtpd?\[[0-9]+\]: fingerprint=[0-9A-F:]+$ -postfix/smtpd?\[[0-9]+\]: setting up TLS connection (from|to) [^[:space:]]+\[[\.0-9]+\]$ -postfix/smtpd?\[[0-9]+\]: verify error:num=(10:certificate has expired|18:self signed certificate|19:self signed certificate in certificate chain|20:unable to get local issuer certificate|21:unable to verify the first certificate|26:unsupported certificate purpose|27:certificate not trusted)$ -postfix/smtpd?\[[0-9]+\]: warning: (numeric|malformed) domain name in resource data of MX record for [^[:space:]]+: [^[:space:]]*$ -postfix/smtpd?\[[0-9]+\]: warning: valid_hostname: (empty hostname|invalid character [0-9]+\(decimal\): [^[:space:]]+)$ -postfix/smtpd\[[0-9]+\]: ((dis)?connect|setting up TLS connection|lost connection after AUTH) from [^[:space:]]+\[[\.0-9]+\]$ -postfix/smtpd\[[0-9]+\]: (lost connection|timeout) after [^ ]+ from [^[:space:]]+\[[\.0-9]+\]$ -postfix/smtpd\[[0-9]+\]: SSL_accept error from [^[:space:]]+\[[\.0-9]+\]: 0 -postfix/smtpd\[[0-9]+\]: [0-9]+:error:0407006A:rsa routines:RSA_padding_check_PKCS1_type_1:block type is not 01:rsa_pk1\.c:100: -postfix/smtpd\[[0-9]+\]: [0-9]+:error:1408807A:SSL routines:SSL3_GET_CERT_VERIFY:bad rsa signature:s3_srvr\.c:1833: -postfix/smtpd\[[0-9]+\]: [A-Z0-9]+: [^[:space:]]+\[[\.0-9]+\], sasl_method=PLAIN, sasl_username=[[:alnum:]]+$ -postfix/smtpd\[[0-9]+\]: too many errors after RCPT from [^[:space:]]+\[[\.0-9]+\]$ -postfix/smtpd\[[0-9]+\]: warning: Illegal address syntax from [^[:space:]\[]+\[[\.0-9]+\] in (MAIL|RCPT) command: (<[^>]+>)?$ -postfix/smtpd\[[0-9]+\]: warning: [\.0-9]+: address not listed for hostname [^[:space:]]+$ -postfix/smtpd\[[0-9]+\]: warning: [\.0-9]+: hostname [^[:space:]]+ verification failed: Host name has no address$ -postfix/smtpd\[[0-9]+\]: warning: [^[:space:]]+\[[\.0-9]+\] sent ([^[:space:]]+ header|mail content) instead of SMTP command: .* -postfix/smtpd\[[0-9]+\]: warning: [^[:space:]]+\[[\.0-9]+\]: hostname [^[:space:]]+ verification failed: Host not found$ -postfix/smtpd\[[0-9]+\]: warning: numeric result [\.0-9]+ in address->name lookup for [\.0-9]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/[[:alnum:]]+\[[0-9]+\]: table has changed -- exiting$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/cleanup\[[0-9]+\]: [A-Z0-9]+: message-id=.*$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/cleanup\[[0-9]+\]: warning: premature end-of-input from cleanup socket while reading input attribute name$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/local\[[0-9]+\]: warning: unable to create lock file /var/mail/[[:alnum:]]+\.lock: Permission denied$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/master\[[0-9]+\]: reload configuration$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/n?qmgr\[[0-9]+\]: [A-Z0-9]+: from=<[^,]*>, status=expired, returned to sender$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/n?qmgr\[[0-9]+\]: [A-Z0-9]+: skipped, still being delivered$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/postfix-script: refreshing the Postfix mail system$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtp\[[0-9]+\]: Peer certi?ficate could not be verified$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtp\[[0-9]+\]: SSL_connect error to [^[:space:]]+: -1 +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtp\[[0-9]+\]: [A-Z0-9]+: enabling PIX \. workaround for [^[:space:]]+\[[\.0-9]+\]$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtp\[[0-9]+\]: [^[:space:]]+ status=deferred \(connect to [^[:space:]]+\[[\.0-9]+\]: (Connection refused|server refused mail service)\)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtp\[[0-9]+\]: connect to [^[:space:]]+\[[\.0-9]+\]: (Connection (refused|reset by peer|timed out)|read timeout|server (refused mail service|dropped connection)|No route to host) \(port 25\)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtp\[[0-9]+\]: setting up TLS connection to [^[:space:]]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtp\[[0-9]+\]: verify error:num=10:certificate has expired$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtp\[[0-9]+\]: warning: bad size limit "truncates" in EHLO reply from [^[:space:]]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtp\[[0-9]+\]: warning: host [^[:space:]]+\[[\.0-9]+\] (greeted me|replied to HELO/EHLO) with my own hostname [^[:space:]]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtp\[[0-9]+\]: warning: no MX host for [^[:space:]]+ has a valid A record$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd?\[[0-9]+\]: (Unv|V)erified: subject_CN=.*, issuer=.*$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd?\[[0-9]+\]: TLS connection established (from|to) [^[:space:]]+: (SSL|TLS)v[123] with cipher [^[:space:]]+ \([0-9/]+ bits\)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd?\[[0-9]+\]: cert has expired$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd?\[[0-9]+\]: fingerprint=[0-9A-F:]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd?\[[0-9]+\]: setting up TLS connection (from|to) [^[:space:]]+\[[\.0-9]+\]$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd?\[[0-9]+\]: verify error:num=(10:certificate has expired|18:self signed certificate|19:self signed certificate in certificate chain|20:unable to get local issuer certificate|21:unable to verify the first certificate|26:unsupported certificate purpose|27:certificate not trusted)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd?\[[0-9]+\]: warning: (numeric|malformed) domain name in resource data of MX record for [^[:space:]]+: [^[:space:]]*$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd?\[[0-9]+\]: warning: valid_hostname: (empty hostname|invalid character [0-9]+\(decimal\): [^[:space:]]+)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd\[[0-9]+\]: ((dis)?connect|setting up TLS connection|lost connection after AUTH) from [^[:space:]]+\[[\.0-9]+\]$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd\[[0-9]+\]: (lost connection|timeout) after [^ ]+ from [^[:space:]]+\[[\.0-9]+\]$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd\[[0-9]+\]: SSL_accept error from [^[:space:]]+\[[\.0-9]+\]: 0 +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd\[[0-9]+\]: [0-9]+:error:0407006A:rsa routines:RSA_padding_check_PKCS1_type_1:block type is not 01:rsa_pk1\.c:100: +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd\[[0-9]+\]: [0-9]+:error:1408807A:SSL routines:SSL3_GET_CERT_VERIFY:bad rsa signature:s3_srvr\.c:1833: +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd\[[0-9]+\]: [A-Z0-9]+: [^[:space:]]+\[[\.0-9]+\], sasl_method=PLAIN, sasl_username=[[:alnum:]]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd\[[0-9]+\]: too many errors after RCPT from [^[:space:]]+\[[\.0-9]+\]$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd\[[0-9]+\]: warning: Illegal address syntax from [^[:space:]\[]+\[[\.0-9]+\] in (MAIL|RCPT) command: (<[^>]+>)?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd\[[0-9]+\]: warning: [\.0-9]+: address not listed for hostname [^[:space:]]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd\[[0-9]+\]: warning: [\.0-9]+: hostname [^[:space:]]+ verification failed: Host name has no address$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd\[[0-9]+\]: warning: [^[:space:]]+\[[\.0-9]+\] sent ([^[:space:]]+ header|mail content) instead of SMTP command: .* +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd\[[0-9]+\]: warning: [^[:space:]]+\[[\.0-9]+\]: hostname [^[:space:]]+ verification failed: Host not found$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd\[[0-9]+\]: warning: numeric result [\.0-9]+ in address->name lookup for [\.0-9]+$ # These are only for postfix >= 2.0: -postfix/qmgr\[[0-9]+\]: [A-Z0-9]+: to=<[^,]+, relay=none, delay=[0-9]+, status=deferred \(connect to [^[:space:]]+\[[\.0-9]+\]: server dropped connection without sending the initial greeting\)$ -postfix/smtp\[[0-9]+\]: connect to [^[:space:]]+\[[\.0-9]+\]: server dropped connection without sending the initial greeting \(port 25\)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/qmgr\[[0-9]+\]: [A-Z0-9]+: to=<[^,]+, relay=none, delay=[0-9]+, status=deferred \(connect to [^[:space:]]+\[[\.0-9]+\]: server dropped connection without sending the initial greeting\)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtp\[[0-9]+\]: connect to [^[:space:]]+\[[\.0-9]+\]: server dropped connection without sending the initial greeting \(port 25\)$ ### ignore.d.server/postgresql -postgres\[[0-9]+\]: \[[0-9-]+\] \^ICPU .* sec elapsed .* sec\.$ -postgres\[[0-9]+\]: \[[0-9-]+\] \^ITotal CPU .* sec elapsed .* sec\.$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postgres\[[0-9]+\]: \[[0-9-]+\] \^ICPU .* sec elapsed .* sec\.$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postgres\[[0-9]+\]: \[[0-9-]+\] \^ITotal CPU .* sec elapsed .* sec\.$ ### ignore.d.server/ppp -chat\[[0-9]+\]: abort on \(.*\)$ -chat\[[0-9]+\]: expect \(.*\)$ -chat\[[0-9]+\]: send \(AT.*\^M\)$ -chat\[[0-9]+\]: -- got it$ -chat\[[0-9]+\]: AT.*\^M\^M$ -chat\[[0-9]+\]: \^M$ -chat\[[0-9]+\]: CONNECT$ -chat\[[0-9]+\]: OK$ -chat\[[0-9]+\]: send \(\\d\)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ chat\[[0-9]+\]: abort on \(.*\)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ chat\[[0-9]+\]: expect \(.*\)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ chat\[[0-9]+\]: send \(AT.*\^M\)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ chat\[[0-9]+\]: -- got it$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ chat\[[0-9]+\]: AT.*\^M\^M$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ chat\[[0-9]+\]: \^M$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ chat\[[0-9]+\]: CONNECT$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ chat\[[0-9]+\]: OK$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ chat\[[0-9]+\]: send \(\\d\)$ ### ignore.d.server/proftpd -proftpd\[[0-9]+\]: No certificate files found! $ -proftpd\[[0-9]+\]: [^[:space:]]+ ([^[:space:]\[]+\[[\.0-9]\]) - Refused PORT.* (address mismatch)\. $ -proftpd\[[0-9]+\]: [^[:space:]]+ \([^[:space:]\[]+\[[\.0-9]+\]\) - FTP (login timed out|no transfer timeout), disconnected\. $ -proftpd\[[0-9]+\]: [^[:space:]]+ \([^[:space:]\[]+\[[\.0-9]+\]\) - FTP session (closed|opened)\. $ -proftpd\[[0-9]+\]: [^[:space:]]+ \([^[:space:]\[]+\[[\.0-9]+\]\) - USER [^[:space:]]+: (Login successful\.|no such user found from .*\[[\.0-9]+\] to [\.0-9]+:21) $ -proftpd\[[0-9]+\]: [^[:space:]]+ \([^[:space:]\[]+\[[\.0-9]+\]\) - no such user '[^[:space:]]+' $ -proftpd\[[0-9]+\]: connect from [\.0-9]+ $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ proftpd\[[0-9]+\]: No certificate files found! $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ proftpd\[[0-9]+\]: [^[:space:]]+ ([^[:space:]\[]+\[[\.0-9]\]) - Refused PORT.* (address mismatch)\. $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ proftpd\[[0-9]+\]: [^[:space:]]+ \([^[:space:]\[]+\[[\.0-9]+\]\) - FTP (login timed out|no transfer timeout), disconnected\. $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ proftpd\[[0-9]+\]: [^[:space:]]+ \([^[:space:]\[]+\[[\.0-9]+\]\) - FTP session (closed|opened)\. $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ proftpd\[[0-9]+\]: [^[:space:]]+ \([^[:space:]\[]+\[[\.0-9]+\]\) - USER [^[:space:]]+: (Login successful\.|no such user found from .*\[[\.0-9]+\] to [\.0-9]+:21) $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ proftpd\[[0-9]+\]: [^[:space:]]+ \([^[:space:]\[]+\[[\.0-9]+\]\) - no such user '[^[:space:]]+' $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ proftpd\[[0-9]+\]: connect from [\.0-9]+ $ ### ignore.d.server/rpld -rpld\[[0-9]+\]: client [:a-f0-9]+ requested block [\.0-9]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ rpld\[[0-9]+\]: client [:a-f0-9]+ requested block [\.0-9]+$ ### ignore.d.server/samba -smbd\[[0-9]+\]: read(_socket)?_data: (read|recv) failure for 4\. Error = (No route to host|Connection reset by peer)$ -smbd\[[0-9]+\]: \[[/0-9]+ [0-9:]+, [0-9]+\] lib/util_sock.c:read(_socket)?_data\([0-9]+\)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ smbd\[[0-9]+\]: read(_socket)?_data: (read|recv) failure for 4\. Error = (No route to host|Connection reset by peer)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ smbd\[[0-9]+\]: \[[/0-9]+ [0-9:]+, [0-9]+\] lib/util_sock.c:read(_socket)?_data\([0-9]+\)$ ### ignore.d.server/sfs-client -: nfsmounter: mounted /sfs/\.linuxmnt/[^[:blank:]]+:[0-9a-z]+/r$ -: sfsrwcd: [^[:blank:]]+:[0-9a-z]+ deleted$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ : nfsmounter: mounted /sfs/\.linuxmnt/[^[:blank:]]+:[0-9a-z]+/r$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ : sfsrwcd: [^[:blank:]]+:[0-9a-z]+ deleted$ ### ignore.d.server/sfs-server -: sfsauthd: serving [^:]+:[0-9a-z]+$ -: sfssd: accepted connection from [\.0-9]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ : sfsauthd: serving [^:]+:[0-9a-z]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ : sfssd: accepted connection from [\.0-9]+$ ### ignore.d.server/spamassassin -spamd\[[0-9]+\]: Creating default_prefs -spamd\[[0-9]+\]: connection from .* at port -spamd\[[0-9]+\]: clean message for -spamd\[[0-9]+\]: identified spam for -spamd\[[0-9]+\]: skipped large message in +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ spamd\[[0-9]+\]: Creating default_prefs +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ spamd\[[0-9]+\]: connection from .* at port +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ spamd\[[0-9]+\]: clean message for +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ spamd\[[0-9]+\]: identified spam for +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ spamd\[[0-9]+\]: skipped large message in ### ignore.d.server/squid -squid\[[0-9]+\]: Finished. Wrote [0-9]+ entries\. $ -squid\[[0-9]+\]: Took [\.0-9]+ seconds \( *[\.0-9]+ entries/sec\)\. $ -squid\[[0-9]+\]: (Closing Pinger socket|Pinger socket opened) on FD [0-9]+$ -squid\[[0-9]+\]: (access|store)LogRotate: Rotating(\.)?$ -squid\[[0-9]+\]: NETDB state saved;$ -squid\[[0-9]+\]: helperOpenServers: Starting [0-9]+ '.*' processes -squid\[[0-9]+\]: logfileRotate: /var/log/squid/(access|store).log $ -squid\[[0-9]+\]: sslReadServer: FD [0-9]+: read failure: \(104\) Connection reset by peer $ -squid\[[0-9]+\]: storeDirWriteCleanLogs: Starting\.\.\. $ -squid\[[0-9]+\]: urlParse: Illegal character in hostname '[^']+' $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ squid\[[0-9]+\]: Finished. Wrote [0-9]+ entries\. $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ squid\[[0-9]+\]: Took [\.0-9]+ seconds \( *[\.0-9]+ entries/sec\)\. $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ squid\[[0-9]+\]: (Closing Pinger socket|Pinger socket opened) on FD [0-9]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ squid\[[0-9]+\]: (access|store)LogRotate: Rotating(\.)?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ squid\[[0-9]+\]: NETDB state saved;$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ squid\[[0-9]+\]: helperOpenServers: Starting [0-9]+ '.*' processes +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ squid\[[0-9]+\]: logfileRotate: /var/log/squid/(access|store).log $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ squid\[[0-9]+\]: sslReadServer: FD [0-9]+: read failure: \(104\) Connection reset by peer $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ squid\[[0-9]+\]: storeDirWriteCleanLogs: Starting\.\.\. $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ squid\[[0-9]+\]: urlParse: Illegal character in hostname '[^']+' $ ### ignore.d.server/ssh -sshd\[[0-9]+\]: syslogin_perform_logout: logout\(\) returned an error$ -sshd\[[0-9]+\]: Could not reverse map address .*\. -sshd\[[0-9]+\]: Connection closed by .* -sshd\[[0-9]+\]: Did not receive ident(ification)? string from [\.0-9]+$ -sshd\[[0-9]+\]: scanned from [\.0-9]+ with SSH-1\.0-SSH_Version_Mapper\. Don't panic\.$ -sshd\[[0-9]+\]: Disconnecting: Your ssh version is too old and is no longer supported\. Please install a newer version\.$ -sshd\[[0-9]+\]: Accepted (keyboard-interactive|password|publickey) for [[:alnum:]]+ from [\.0-9]+ port [0-9]+( ssh2)?$ -sshd\[[0-9]+\]: warning: /etc/hosts.deny, line 15: can't verify hostname: gethostbyname(.*) failed -sshd\[[0-9]+\]: refused connect from .* -sshd\[[0-9]+\]: Received disconnect from [\.0-9]+: 11: Disconnect requested by Windows SSH Client.$ -sshd\[[0-9]+\]: subsystem request for sftp$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: syslogin_perform_logout: logout\(\) returned an error$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: Could not reverse map address .*\. +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: Connection closed by .* +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: Did not receive ident(ification)? string from [\.0-9]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: scanned from [\.0-9]+ with SSH-1\.0-SSH_Version_Mapper\. Don't panic\.$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: Disconnecting: Your ssh version is too old and is no longer supported\. Please install a newer version\.$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: Accepted (keyboard-interactive|password|publickey) for [[:alnum:]]+ from [\.0-9]+ port [0-9]+( ssh2)?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: warning: /etc/hosts.deny, line 15: can't verify hostname: gethostbyname(.*) failed +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: refused connect from .* +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: Received disconnect from [\.0-9]+: 11: Disconnect requested by Windows SSH Client.$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: subsystem request for sftp$ ### ignore.d.server/ssmtp -sSMTP mail\[[0-9]+\]: .* sent mail for root +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sSMTP mail\[[0-9]+\]: .* sent mail for root ### ignore.d.server/sysklogd -syslogd [\.#0-9]+: restart \(remote reception\)\.$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ syslogd [\.#0-9]+: restart \(remote reception\)\.$ ### ignore.d.server/tftpd -in\.tftpd\[[0-9]+\]: RRQ from [\.0-9]+ filename [^[:space:]]+ $ -in\.tftpd\[[0-9]+\]: tftp: client does not accept options +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ in\.tftpd\[[0-9]+\]: RRQ from [\.0-9]+ filename [^[:space:]]+ $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ in\.tftpd\[[0-9]+\]: tftp: client does not accept options ### ignore.d.server/tmp ## imp -IMP\[[0-9]+\]: FAILED .* to .*:143 as .* +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ IMP\[[0-9]+\]: FAILED .* to .*:143 as .* ## libpam-modules -PAM_unix\[[0-9]+\]: authentication failure; \(uid=0\) -> .* for (imap|netatalk|pop|samba|ssh) service -PAM_unix\[[0-9]+\]: check pass; user unknown$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ PAM_unix\[[0-9]+\]: authentication failure; \(uid=0\) -> .* for (imap|netatalk|pop|samba|ssh) service +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ PAM_unix\[[0-9]+\]: check pass; user unknown$ # old-style pam entries (no longer provided by logcheck but needed on woody) -PAM_.*: .* session (opened|closed) for user .* +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ PAM_.*: .* session (opened|closed) for user .* ## netatalk -afpd\[[0-9]+\]: [^[:space:]]+: E:AFPDaemon: bad function 7A -afpd\[[0-9]+\]: afp_getsrvrparms: stat /volumes/(km/kmstab/kmstab|kp/kp/kp(/kp|/kpstab|stab/kpstab)|misc/flstab/flstab): Permission denied -afpd\[[0-9]+\]: uams_dhx_pam\.c :PAM: (PAM Auth OK!|Success -- .*|User entered a null value -- .*) -afpd\[[0-9]+\]: uams_dhx_pam\.c :PAM: PAM_Error: Authentication failure -- (Bad file descriptor|Invalid argument) -afpd\[[0-9]+\]: uams_dhx_pam\.c :PAM: User entered a null value -- No such file or directory -atalkd\[[0-9]+\]: as_timer sendto: Netvaerket er ikke tilgaengeligt +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: [^[:space:]]+: E:AFPDaemon: bad function 7A +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: afp_getsrvrparms: stat /volumes/(km/kmstab/kmstab|kp/kp/kp(/kp|/kpstab|stab/kpstab)|misc/flstab/flstab): Permission denied +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: uams_dhx_pam\.c :PAM: (PAM Auth OK!|Success -- .*|User entered a null value -- .*) +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: uams_dhx_pam\.c :PAM: PAM_Error: Authentication failure -- (Bad file descriptor|Invalid argument) +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: uams_dhx_pam\.c :PAM: User entered a null value -- No such file or directory +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ atalkd\[[0-9]+\]: as_timer sendto: Netvaerket er ikke tilgaengeligt ## hylafax-server -FaxGetty\[[0-9]+\]: ANSWER: Can not lock modem device -gnome-name-server\[[0-9]+\]: server_is_alive: .* +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ FaxGetty\[[0-9]+\]: ANSWER: Can not lock modem device +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ gnome-name-server\[[0-9]+\]: server_is_alive: .* ## uw-imap -i(map|pop3)d\[[0-9]+\]: (AUTHENTICATE (LOGIN|PLAIN) failure|Login failed)( user=.*)? host=(.* )?\[.*\] +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ i(map|pop3)d\[[0-9]+\]: (AUTHENTICATE (LOGIN|PLAIN) failure|Login failed)( user=.*)? host=(.* )?\[.*\] ## ppp -ipppd\[[0-9]+\]: Connect\[0\]: /dev/ippp[0-9], fd: 12 +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ipppd\[[0-9]+\]: Connect\[0\]: /dev/ippp[0-9], fd: 12 ## misc -kernel: Disorder[0-9] [0-9] [0-9] f[0-9] s[0-9] rr[0-9] -kernel: IP_MASQ:reverse ICMP: failed checksum from .*! -kernel: OPEN: [\.0-9]* -> [\.0-9]* UDP, port: [0-9]* -> [0-9]* -kernel: Packet log: input DENY eth1 PROTO=1 0.0.0.0:5 10.0.0.40:1 L=427 S=0xD0 I=0 F=0x4000 T=255 \(#22\) -kernel: Shorewall:net2all:DROP:.*$ -kernel: lp[0-9]: compatibility mode -kernel: Undo( partial)? (Hoe|loss|retrans) -printer: offline or intervention needed +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: Disorder[0-9] [0-9] [0-9] f[0-9] s[0-9] rr[0-9] +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: IP_MASQ:reverse ICMP: failed checksum from .*! +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: OPEN: [\.0-9]* -> [\.0-9]* UDP, port: [0-9]* -> [0-9]* +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: Packet log: input DENY eth1 PROTO=1 0.0.0.0:5 10.0.0.40:1 L=427 S=0xD0 I=0 F=0x4000 T=255 \(#22\) +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: Shorewall:net2all:DROP:.*$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: lp[0-9]: compatibility mode +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: Undo( partial)? (Hoe|loss|retrans) +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ printer: offline or intervention needed ## Printer and Windows PC at Homebase ignoring change of DHCP (192.168.101 -> 192.168.1) -kernel: Shorewall:all2all:REJECT:.*SRC=192.168.103.17 DST=192.168.101.2 .*$ -kernel: Shorewall:all2all:REJECT:.*SRC=192.168.103.248 DST=192.168.101.22 .*$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: Shorewall:all2all:REJECT:.*SRC=192.168.103.17 DST=192.168.101.2 .*$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: Shorewall:all2all:REJECT:.*SRC=192.168.103.248 DST=192.168.101.22 .*$ ## Non-UDMA hd cable -kernel: hda: status timeout: status=0xd0 \{ Busy \} -kernel: hda: no DRQ after issuing WRITE -kernel: ide0: reset: success +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: hda: status timeout: status=0xd0 \{ Busy \} +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: hda: no DRQ after issuing WRITE +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: ide0: reset: success ## Postfix SASL not working -postfix/smtpd\[[0-9]+\]: unable to open Berkeley db /etc/sasldb: No such file or directory +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd\[[0-9]+\]: unable to open Berkeley db /etc/sasldb: No such file or directory ## ntp-simple -ntpd\[[0-9]+\]: synchronisation lost -ntpd\[[0-9]+\]: synchronisation lost -ntpd\[[0-9]+\]: time reset [\.0-9-]* . -ntpd\[[0-9]+\]: time reset [\.0-9-]+ s +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: synchronisation lost +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: synchronisation lost +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: time reset [\.0-9-]* . +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: time reset [\.0-9-]+ s ## portsentry -portsentry\[[0-9]+\]: attackalert: .* +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ portsentry\[[0-9]+\]: attackalert: .* ## pump -pumpd\[[0-9]+\]: SO_BINDTODEVICE eth0 \(4\) failed: Invalid argument +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pumpd\[[0-9]+\]: SO_BINDTODEVICE eth0 \(4\) failed: Invalid argument ## samba -smbd\[[0-9]+\]: process_local_message: unknown UDP message command code \([0-9a-f]+\) - ignoring. $ -smbd\[[0-9]+\]: read(_socket)?_data: (read|recv) failure for 4\. Error = (No route to host|Connection (reset by peer|timed out)) $ -smbd\[[0-9]+\]: smb_pam_passcheck: PAM: smb_pam_auth failed - Rejecting User [[:alnum:]]+ ! $ -smbd\[[0-9]+\]: yield_connection: tdb_delete for name failed with error Record does not exist\. $ -smbd\[[0-9]+\]: [^[:space:]]+ \([\.0-9]+\) couldn't find service c $ -smbd\[[0-9]+\]: api_srv_net_share_add: Failed to unmarshall SRV_Q_NET_SHARE_ADD. $ -smbd\[[0-9]+\]: prs_mem_get: reading data of size 4 would overrun buffer. $ -smbd\[[0-9]+\]: \[[0-9/]+ [0-9:]+, [0-9]+\] (lib/util_sock.c:read_data|passdb/pampass.c:smb_pam_passcheck|rpc_parse/parse_prs.c:prs_mem_get|rpc_server/srv_(pipe.c:api_rpcTNP|srvsvc.c:api_srv_net_share_add))\([0-9]+\) $ -smbd\[[0-9]+\]: \[[0-9/]+ [0-9:]+, [0-9]+\] smbd/(connection.c:yield_connection|oplock.c:process_local_message|service.c:(find_service|make_connection))\([0-9]+\) $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ smbd\[[0-9]+\]: process_local_message: unknown UDP message command code \([0-9a-f]+\) - ignoring. $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ smbd\[[0-9]+\]: read(_socket)?_data: (read|recv) failure for 4\. Error = (No route to host|Connection (reset by peer|timed out)) $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ smbd\[[0-9]+\]: smb_pam_passcheck: PAM: smb_pam_auth failed - Rejecting User [[:alnum:]]+ ! $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ smbd\[[0-9]+\]: yield_connection: tdb_delete for name failed with error Record does not exist\. $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ smbd\[[0-9]+\]: [^[:space:]]+ \([\.0-9]+\) couldn't find service c $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ smbd\[[0-9]+\]: api_srv_net_share_add: Failed to unmarshall SRV_Q_NET_SHARE_ADD. $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ smbd\[[0-9]+\]: prs_mem_get: reading data of size 4 would overrun buffer. $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ smbd\[[0-9]+\]: \[[0-9/]+ [0-9:]+, [0-9]+\] (lib/util_sock.c:read_data|passdb/pampass.c:smb_pam_passcheck|rpc_parse/parse_prs.c:prs_mem_get|rpc_server/srv_(pipe.c:api_rpcTNP|srvsvc.c:api_srv_net_share_add))\([0-9]+\) $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ smbd\[[0-9]+\]: \[[0-9/]+ [0-9:]+, [0-9]+\] smbd/(connection.c:yield_connection|oplock.c:process_local_message|service.c:(find_service|make_connection))\([0-9]+\) $ ## ssh -sshd\[[0-9]+\]: Failed password for [[:alnum:]]+ from [0-9\.]+ port [0-9]+ ssh2$ -sshd\[[0-9]+\]: packet_set_maxsize: setting to 4096 $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: Failed password for [[:alnum:]]+ from [0-9\.]+ port [0-9]+ ssh2$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: packet_set_maxsize: setting to 4096 $ ## postfix -postfix.*\[[0-9]+\]: .* from= -postfix/smtpd\[[0-9]+\]: warning: Illegal address syntax from [\.[:alnum:]-]+\[[\.0-9]+\] in MAIL command: +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix.*\[[0-9]+\]: .* from= +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd\[[0-9]+\]: warning: Illegal address syntax from [\.[:alnum:]-]+\[[\.0-9]+\] in MAIL command: ## Tulle getting spammed -tulle postfix/smtpd\[[0-9]+\]: too many errors after RCPT from unknown\[\.0-9]+[\] -rpc.mountd: authenticated mount request from .* for .* +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ tulle postfix/smtpd\[[0-9]+\]: too many errors after RCPT from unknown\[\.0-9]+[\] +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ rpc.mountd: authenticated mount request from .* for .* ## snort -snort: .*FrontPage -snort: IDS015 - RPC - portmap-request-status: -snort: IDS029 - SCAN-Possible Queso Fingerprint attempt: -snort: IDS115 - MISC-Traceroute-UDP: -snort: IDS212 - MISC - DNS Zone Transfer: -snort: IDS226 - CVE-1999-0172 - CGI-formmail: -snort: IDS246 - MISC - Large ICMP Packet: -snort: IIS- -snort: MISC-Attempted Sun RPC high port access: -snort: NETBIOS-SMB-C: -snort: NETBIOS-SMB-CD...: -snort: NMAP TCP ping!: -snort: RPC Info Query: -snort: SCAN-SYN FIN: -snort: spp_http_decode: IIS Unicode attack detected: -snort: spp_portscan: End of portscan -snort: spp_portscan: PORTSCAN DETECTED -snort: spp_portscan: portscan status from -snort: WEB-../..: -snort: WEB-CGI-upload.pl: +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ snort: .*FrontPage +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ snort: IDS015 - RPC - portmap-request-status: +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ snort: IDS029 - SCAN-Possible Queso Fingerprint attempt: +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ snort: IDS115 - MISC-Traceroute-UDP: +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ snort: IDS212 - MISC - DNS Zone Transfer: +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ snort: IDS226 - CVE-1999-0172 - CGI-formmail: +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ snort: IDS246 - MISC - Large ICMP Packet: +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ snort: IIS- +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ snort: MISC-Attempted Sun RPC high port access: +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ snort: NETBIOS-SMB-C: +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ snort: NETBIOS-SMB-CD...: +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ snort: NMAP TCP ping!: +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ snort: RPC Info Query: +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ snort: SCAN-SYN FIN: +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ snort: spp_http_decode: IIS Unicode attack detected: +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ snort: spp_portscan: End of portscan +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ snort: spp_portscan: PORTSCAN DETECTED +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ snort: spp_portscan: portscan status from +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ snort: WEB-../..: +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ snort: WEB-CGI-upload.pl: ## postgres -postgres\[[0-9]+\]: \[[0-9-]+\] DEBUG: .* -postgres\[[0-9]+\]: \[[0-9-]+\] LOG: connection received: host=\[local\]$ -postgres\[[0-9]+\]: \[[0-9-]+\] LOG: connection authorized: user=postgres database=template1 -postgres\[[0-9]+\]: \[[0-9-]+\] Re-using: Free/Avail. Space .* EndEmpty/Avail\. Pages .* CPU .* sec\. -postgres\[[0-9]+\]: \[[0-9-]+\] [0-9]*; Re-using: Free/Avail. Space .* EndEmpty/Avail\. Pages .* CPU .* sec\. +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postgres\[[0-9]+\]: \[[0-9-]+\] DEBUG: .* +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postgres\[[0-9]+\]: \[[0-9-]+\] LOG: connection received: host=\[local\]$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postgres\[[0-9]+\]: \[[0-9-]+\] LOG: connection authorized: user=postgres database=template1 +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postgres\[[0-9]+\]: \[[0-9-]+\] Re-using: Free/Avail. Space .* EndEmpty/Avail\. Pages .* CPU .* sec\. +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postgres\[[0-9]+\]: \[[0-9-]+\] [0-9]*; Re-using: Free/Avail. Space .* EndEmpty/Avail\. Pages .* CPU .* sec\. ## amavis -amavis\[[0-9]+\]: warning - MIME::Parser error: .* +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ amavis\[[0-9]+\]: warning - MIME::Parser error: .* ## Misc entries on Gibraltar (using older logcheck and syslog...) --- MARK -- $ -/USR/SBIN/CRON\[[0-9]+\]: \(root\) CMD \(test -x /usr/sbin/logcheck && nice -n10 /usr/sbin/logcheck\) $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ -- MARK -- $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ /USR/SBIN/CRON\[[0-9]+\]: \(root\) CMD \(test -x /usr/sbin/logcheck && nice -n10 /usr/sbin/logcheck\) $ ### ignore.d.server/ucd-snmp -ucd-snmp\[[0-9]+\]: Connection from .* +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ucd-snmp\[[0-9]+\]: Connection from .* ### ignore.d.server/uptimed -uptimed: moving up to position [0-9]+: [0-9]+ days, [0-9:]+ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ uptimed: moving up to position [0-9]+: [0-9]+ days, [0-9:]+ diff --git a/logcheck/ignore.d.server/mailutils-imap4d b/logcheck/ignore.d.server/mailutils-imap4d index 328d24c..c90dd27 100644 --- a/logcheck/ignore.d.server/mailutils-imap4d +++ b/logcheck/ignore.d.server/mailutils-imap4d @@ -1,5 +1,5 @@ -gnu-imap4d\[[0-9]+\]: Incoming connection opened$ -gnu-imap4d\[[0-9]+\]: connect from [\.0-9]+$ -gnu-imap4d\[[0-9]+\]: User '[[:alnum:]]+' logged in$ -gnu-imap4d\[[0-9]+\]: Session timed out for user: [[:alnum:]]+$ -gnu-imap4d\[[0-9]+\]: got signal Alarm clock$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ gnu-imap4d\[[0-9]+\]: Incoming connection opened$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ gnu-imap4d\[[0-9]+\]: connect from [\.0-9]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ gnu-imap4d\[[0-9]+\]: User '[[:alnum:]]+' logged in$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ gnu-imap4d\[[0-9]+\]: Session timed out for user: [[:alnum:]]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ gnu-imap4d\[[0-9]+\]: got signal Alarm clock$ diff --git a/logcheck/ignore.d.server/misc b/logcheck/ignore.d.server/misc index 5d2ec5d..fa4f07c 100644 --- a/logcheck/ignore.d.server/misc +++ b/logcheck/ignore.d.server/misc @@ -1,11 +1,11 @@ # Figure out if these belong to dhcp or dhcp3-common (or dhclient?) -dhcpd.*: Reclaiming( REQUESTed) abandoned IP address [\.0-9]+ -dhcpd.*: already acking lease -dhcpd.*: send_packet: Connection refused -dhcpd.*: fallback_discard: Connection refused +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd.*: Reclaiming( REQUESTed) abandoned IP address [\.0-9]+ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd.*: already acking lease +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd.*: send_packet: Connection refused +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhcpd.*: fallback_discard: Connection refused # These show up when isdnutils is installed, but isn't strictly related to those packages -kernel: isdn_net: call from [,0-9]+ -> [0-9]+$ -kernel: isdn_net: Service-Indicator not [0-9], ignored$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: isdn_net: call from [,0-9]+ -> [0-9]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: isdn_net: Service-Indicator not [0-9], ignored$ # This one shows up with firewalls blocking SMB ports non-silently -kernel: Packet log: input DENY .*:(137|138) .*:(137|138) .*$ -kernel: Shorewall:net2all:DROP:.* (SPT|DPT)=(13[789]|445) .*$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: Packet log: input DENY .*:(137|138) .*:(137|138) .*$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: Shorewall:net2all:DROP:.* (SPT|DPT)=(13[789]|445) .*$ diff --git a/logcheck/ignore.d.server/murasaki b/logcheck/ignore.d.server/murasaki index a4af7d5..3fcea13 100644 --- a/logcheck/ignore.d.server/murasaki +++ b/logcheck/ignore.d.server/murasaki @@ -1,7 +1,7 @@ -murasaki\.usb\[[0-9]+\]: found depended module="[[:alnum:]]+"$ -murasaki\.(usb|net)\[[0-9]+\]: try expanding "\[net\]"$ -murasaki\.(usb|net)\[[0-9]+\]: dependent\(net\) is found$ -murasaki\.(usb|net)\[[0-9]+\]: net device is (added|removed|(un)?register(e)?d)$ -murasaki\.(usb|net)\[[0-9]+\]: Execuing "net" "(stop|start)"$ -murasaki\.(usb|net)\[[0-9]+\]: execute if(up|down) (eth|(i)?ppp|irda)[0-9]$ -murasaki\.usb\[[0-9]+\]: (MATCH\(audio\) -> match_flags:[[:alnum:]]+ )?vendor:[[:alnum:]]+ product:[[:alnum:]]+ Dclass:[[:alnum:]]+ Dsubclass:[[:alnum:]]+ Dprotocol:[[:alnum:]]+ Iclass:[[:alnum:]]+ Isubclass:[[:alnum:]]+ Iprotocol:[[:alnum:]]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ murasaki\.usb\[[0-9]+\]: found depended module="[[:alnum:]]+"$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ murasaki\.(usb|net)\[[0-9]+\]: try expanding "\[net\]"$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ murasaki\.(usb|net)\[[0-9]+\]: dependent\(net\) is found$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ murasaki\.(usb|net)\[[0-9]+\]: net device is (added|removed|(un)?register(e)?d)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ murasaki\.(usb|net)\[[0-9]+\]: Execuing "net" "(stop|start)"$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ murasaki\.(usb|net)\[[0-9]+\]: execute if(up|down) (eth|(i)?ppp|irda)[0-9]$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ murasaki\.usb\[[0-9]+\]: (MATCH\(audio\) -> match_flags:[[:alnum:]]+ )?vendor:[[:alnum:]]+ product:[[:alnum:]]+ Dclass:[[:alnum:]]+ Dsubclass:[[:alnum:]]+ Dprotocol:[[:alnum:]]+ Iclass:[[:alnum:]]+ Isubclass:[[:alnum:]]+ Iprotocol:[[:alnum:]]+$ diff --git a/logcheck/ignore.d.server/nagios b/logcheck/ignore.d.server/nagios index 248f54c..33e437f 100644 --- a/logcheck/ignore.d.server/nagios +++ b/logcheck/ignore.d.server/nagios @@ -1,2 +1,2 @@ -nagios: Auto-save of retention data completed successfully\. $ -nagios: LOG ROTATION: DAILY $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ nagios: Auto-save of retention data completed successfully\. $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ nagios: LOG ROTATION: DAILY $ diff --git a/logcheck/ignore.d.server/netatalk.changes b/logcheck/ignore.d.server/netatalk.changes index 3d91662..92b68ef 100644 --- a/logcheck/ignore.d.server/netatalk.changes +++ b/logcheck/ignore.d.server/netatalk.changes @@ -1,31 +1,31 @@ # Lines with "[^[:space:]]+:" at the beginning are for netatalk 1.6.x or newer. -afpd\[[0-9]+\]: (atp_rresp|afp_die: asp_shutdown): Connection timed out$ -afpd\[[0-9]+\]: [^[:space:]]+: D5:AFPDaemon: Parsing volset [^[:space:]]+$ -afpd\[[0-9]+\]: [^[:space:]]+: D5:AFPDaemon: using codepage directory: /etc/netatalk/nls/maccode\.[\.a-z0-9-]+$ -afpd\[[0-9]+\]: [^[:space:]]+: E:AFPDaemon: afp_alarm: child timed out$ -afpd\[[0-9]+\]: [^[:space:]]+: E:Default: atp_rresp: Connection timed out$ -afpd\[[0-9]+\]: [^[:space:]]+: E:Default: dsi_stream_read\(-1\): Connection reset by peer$ -afpd\[[0-9]+\]: [^[:space:]]+: E:Default: dsi_stream_write: Broken pipe$ -afpd\[[0-9]+\]: [^[:space:]]+: I:AFPDaemon: (afp_flushfork|afp_read|getforkparms): (ad_refresh|of_find): (No such file or directory|No such process|Permission denied)$ -afpd\[[0-9]+\]: [^[:space:]]+: I:AFPDaemon: (registering [[:alnum:]]+ \(uid [0-9]+\) on [\.0-9]+ as|removed) /[^[:space:]]+/net[\.0-9]+node[0-9]+$ -afpd\[[0-9]+\]: [^[:space:]]+: I:AFPDaemon: Connection terminated$ -afpd\[[0-9]+\]: [^[:space:]]+: I:AFPDaemon: [\.[:alnum:]]+ read, [\.[:alnum:]]+ written$ -afpd\[[0-9]+\]: [^[:space:]]+: I:AFPDaemon: login [[:alnum:]]+ \(uid [0-9]+, gid [0-9]+\)( AFP2\.2)?$ -afpd\[[0-9]+\]: [^[:space:]]+: I:AFPDaemon: logout [[:alnum:]]+$ -afpd\[[0-9]+\]: [^[:space:]]+: I:AFPDaemon: session from [\.:0-9]+ on [\.:0-9]+$ -afpd\[[0-9]+\]: [^[:space:]]+: I:Default: (server_child\[[0-9]+\] [0-9]+ )?(done|exited 1)$ -afpd\[[0-9]+\]: [^[:space:]]+: I:Default: ASIP session:[0-9]+\([0-9]+\) from [\.:0-9]+\([0-9]+\)$ -afpd\[[0-9]+\]: [^[:space:]]+: I:Default: CNID DB initialized using Sleepycat Software: Berkeley DB( [\.0-9]+: \([^\(]+\))?$ -afpd\[[0-9]+\]: [^[:space:]]+: I:Default: asp_alrm: [0-9]+ timed out$ -afpd\[[0-9]+\]: [^[:space:]]+: I:UAMSDaemon: ((dhx|cleartext|randnum/rand2num) )?login: [[:alnum:]]+$ -afpd\[[0-9]+\]: [^[:space:]]+: I:UAMSDaemon: login noauth$ -afpd\[[0-9]+\]: [^[:space:]]+: I:UAMSDaemon: uams_dhx_pam.c :PAM: PAM (Auth OK!|Success -- Success)$ -afpd\[[0-9]+\]: [^[:space:]]+: S:Logger: can't open Logfile /var/log/netatalk.log$ -afpd\[[0-9]+\]: [_[:alnum:]]+(\(-?[0-9]+\))?: stat [^:]+: (No such file or directory|Permission denied)$ -afpd\[[0-9]+\]: dsi_stream_read\(0\): (No such file or directory|No such process|Permission denied)$ -afpd\[[0-9]+\]: dsi_stream_read\(0\): Success$ -afpd\[[0-9]+\]: error stat'ing /[^[:space:]]+/net[\.0-9]+node[0-9]+: No such file or directory$ -atalkd\[[0-9]+\]: (as_timer|nbp brrq) sendto [\.0-9]+( \([0-9]+\))?: Network is unreachable $ -atalkd\[[0-9]+\]: zip (ignoring gnireply|gnireply from [\.0-9]+ \([[:alnum:]]+ [[:alnum:]]+\)) $ -papd\[[0-9]+\]: [^[:space:]]+: I:PAPDaemon: child [0-9]+ done$ -papd\[[0-9]+\]: [^[:space:]]+: I:PAPDaemon: child [0-9]+ for "[^"]+" from [\.0-9]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: (atp_rresp|afp_die: asp_shutdown): Connection timed out$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: [^[:space:]]+: D5:AFPDaemon: Parsing volset [^[:space:]]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: [^[:space:]]+: D5:AFPDaemon: using codepage directory: /etc/netatalk/nls/maccode\.[\.a-z0-9-]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: [^[:space:]]+: E:AFPDaemon: afp_alarm: child timed out$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: [^[:space:]]+: E:Default: atp_rresp: Connection timed out$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: [^[:space:]]+: E:Default: dsi_stream_read\(-1\): Connection reset by peer$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: [^[:space:]]+: E:Default: dsi_stream_write: Broken pipe$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: [^[:space:]]+: I:AFPDaemon: (afp_flushfork|afp_read|getforkparms): (ad_refresh|of_find): (No such file or directory|No such process|Permission denied)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: [^[:space:]]+: I:AFPDaemon: (registering [[:alnum:]]+ \(uid [0-9]+\) on [\.0-9]+ as|removed) /[^[:space:]]+/net[\.0-9]+node[0-9]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: [^[:space:]]+: I:AFPDaemon: Connection terminated$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: [^[:space:]]+: I:AFPDaemon: [\.[:alnum:]]+ read, [\.[:alnum:]]+ written$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: [^[:space:]]+: I:AFPDaemon: login [[:alnum:]]+ \(uid [0-9]+, gid [0-9]+\)( AFP2\.2)?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: [^[:space:]]+: I:AFPDaemon: logout [[:alnum:]]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: [^[:space:]]+: I:AFPDaemon: session from [\.:0-9]+ on [\.:0-9]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: [^[:space:]]+: I:Default: (server_child\[[0-9]+\] [0-9]+ )?(done|exited 1)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: [^[:space:]]+: I:Default: ASIP session:[0-9]+\([0-9]+\) from [\.:0-9]+\([0-9]+\)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: [^[:space:]]+: I:Default: CNID DB initialized using Sleepycat Software: Berkeley DB( [\.0-9]+: \([^\(]+\))?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: [^[:space:]]+: I:Default: asp_alrm: [0-9]+ timed out$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: [^[:space:]]+: I:UAMSDaemon: ((dhx|cleartext|randnum/rand2num) )?login: [[:alnum:]]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: [^[:space:]]+: I:UAMSDaemon: login noauth$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: [^[:space:]]+: I:UAMSDaemon: uams_dhx_pam.c :PAM: PAM (Auth OK!|Success -- Success)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: [^[:space:]]+: S:Logger: can't open Logfile /var/log/netatalk.log$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: [_[:alnum:]]+(\(-?[0-9]+\))?: stat [^:]+: (No such file or directory|Permission denied)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: dsi_stream_read\(0\): (No such file or directory|No such process|Permission denied)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: dsi_stream_read\(0\): Success$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: error stat'ing /[^[:space:]]+/net[\.0-9]+node[0-9]+: No such file or directory$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ atalkd\[[0-9]+\]: (as_timer|nbp brrq) sendto [\.0-9]+( \([0-9]+\))?: Network is unreachable $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ atalkd\[[0-9]+\]: zip (ignoring gnireply|gnireply from [\.0-9]+ \([[:alnum:]]+ [[:alnum:]]+\)) $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ papd\[[0-9]+\]: [^[:space:]]+: I:PAPDaemon: child [0-9]+ done$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ papd\[[0-9]+\]: [^[:space:]]+: I:PAPDaemon: child [0-9]+ for "[^"]+" from [\.0-9]+$ diff --git a/logcheck/ignore.d.server/netsaint b/logcheck/ignore.d.server/netsaint index 90743ec..363b73e 100644 --- a/logcheck/ignore.d.server/netsaint +++ b/logcheck/ignore.d.server/netsaint @@ -1,5 +1,5 @@ -netsaint: (HOST|SERVICE) (ALERT|NOTIFICATION|FLAPPING ALERT): .*$ -netsaint: Auto-save of retention data completed successfully\. $ -netsaint: Caught SIGTERM, shutting down\.\.\. $ -netsaint: Entering active mode\.\.\. $ -netsaint: NetSaint [\.0-9]+ starting\.\.\. \(PID=[0-9]+\) $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ netsaint: (HOST|SERVICE) (ALERT|NOTIFICATION|FLAPPING ALERT): .*$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ netsaint: Auto-save of retention data completed successfully\. $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ netsaint: Caught SIGTERM, shutting down\.\.\. $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ netsaint: Entering active mode\.\.\. $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ netsaint: NetSaint [\.0-9]+ starting\.\.\. \(PID=[0-9]+\) $ diff --git a/logcheck/ignore.d.server/nfs-kernel-server b/logcheck/ignore.d.server/nfs-kernel-server index ce04275..77b4b17 100644 --- a/logcheck/ignore.d.server/nfs-kernel-server +++ b/logcheck/ignore.d.server/nfs-kernel-server @@ -1,3 +1,3 @@ -mountd\[[0-9]+\]: NFS mount of /[^[:space:]]+ attempted from [\.0-9]+$ -mountd\[[0-9]+\]: /[^[:space:]]+ has been mounted by [\.0-9]+$ -rpc\.mountd: authenticated unmount request from [\.0-9]+:[0-9]+ for /[^[:space:]]+ \(/[^[:space:]\)]+\) $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ mountd\[[0-9]+\]: NFS mount of /[^[:space:]]+ attempted from [\.0-9]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ mountd\[[0-9]+\]: /[^[:space:]]+ has been mounted by [\.0-9]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ rpc\.mountd: authenticated unmount request from [\.0-9]+:[0-9]+ for /[^[:space:]]+ \(/[^[:space:]\)]+\) $ diff --git a/logcheck/ignore.d.server/non-debian b/logcheck/ignore.d.server/non-debian index 4f67cf7..4f6bc26 100644 --- a/logcheck/ignore.d.server/non-debian +++ b/logcheck/ignore.d.server/non-debian @@ -2,10 +2,10 @@ # (and advertised through DHCP) # # HP printers -printer: peripheral low-power state$ -printer: paper out$ -printer: error cleared$ -printer: powered up$ -printer: ready to print$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ printer: peripheral low-power state$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ printer: paper out$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ printer: error cleared$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ printer: powered up$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ printer: ready to print$ # FloppyFW DHCP server -[0-9A-F]+ 400 DHCP SERVER Offered \| Offering: [\.0-9]+ To: [0-9A-F]+ By: [\.0-9]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ [0-9A-F]+ 400 DHCP SERVER Offered \| Offering: [\.0-9]+ To: [0-9A-F]+ By: [\.0-9]+$ diff --git a/logcheck/ignore.d.server/ntp-simple.changes b/logcheck/ignore.d.server/ntp-simple.changes index 4cfc389..54438ad 100644 --- a/logcheck/ignore.d.server/ntp-simple.changes +++ b/logcheck/ignore.d.server/ntp-simple.changes @@ -1,6 +1,6 @@ -ntpd\[[0-9]+\]: kern_enable is 1$ -ntpd\[[0-9]+\]: kernel time discipline status [0-9]+$ -ntpd\[[0-9]+\]: precision = [0-9]+ usec$ -ntpd\[[0-9]+\]: signal_no_reset: signal 13 had flags [0-9]+$ -ntpd\[[0-9]+\]: using kernel phase-lock loop [0-9]+$ -ntpd\[[0-9]+\]: ntpd [\.0-9]+ [a-zA-Z]+ [a-zA-Z]+ [0-9]+ [0-9:]+ UTC 200[2-9]+ \(2\)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: kern_enable is 1$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: kernel time discipline status [0-9]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: precision = [0-9]+ usec$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: signal_no_reset: signal 13 had flags [0-9]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: using kernel phase-lock loop [0-9]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: ntpd [\.0-9]+ [a-zA-Z]+ [a-zA-Z]+ [0-9]+ [0-9:]+ UTC 200[2-9]+ \(2\)$ diff --git a/logcheck/ignore.d.server/pop-before-smtp b/logcheck/ignore.d.server/pop-before-smtp index 4ff492b..5394582 100644 --- a/logcheck/ignore.d.server/pop-before-smtp +++ b/logcheck/ignore.d.server/pop-before-smtp @@ -1 +1 @@ -pop-before-smtp\[[0-9]+\]: (opening|closing) relay for [\.0-9]+( --- not in mynetworks)?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pop-before-smtp\[[0-9]+\]: (opening|closing) relay for [\.0-9]+( --- not in mynetworks)?$ diff --git a/logcheck/ignore.d.server/postfix b/logcheck/ignore.d.server/postfix index bda61d5..8f35255 100644 --- a/logcheck/ignore.d.server/postfix +++ b/logcheck/ignore.d.server/postfix @@ -1,42 +1,42 @@ -postfix/[[:alnum:]]+\[[0-9]+\]: table has changed -- exiting$ -postfix/cleanup\[[0-9]+\]: [A-Z0-9]+: message-id=.*$ -postfix/cleanup\[[0-9]+\]: warning: premature end-of-input from cleanup socket while reading input attribute name$ -postfix/local\[[0-9]+\]: warning: unable to create lock file /var/mail/[[:alnum:]]+\.lock: Permission denied$ -postfix/master\[[0-9]+\]: reload configuration$ -postfix/n?qmgr\[[0-9]+\]: [A-Z0-9]+: from=<[^,]*>, status=expired, returned to sender$ -postfix/n?qmgr\[[0-9]+\]: [A-Z0-9]+: skipped, still being delivered$ -postfix/postfix-script: refreshing the Postfix mail system$ -postfix/smtp\[[0-9]+\]: Peer certi?ficate could not be verified$ -postfix/smtp\[[0-9]+\]: SSL_connect error to [^[:space:]]+: -1 -postfix/smtp\[[0-9]+\]: [A-Z0-9]+: enabling PIX \. workaround for [^[:space:]]+\[[\.0-9]+\]$ -postfix/smtp\[[0-9]+\]: [^[:space:]]+ status=deferred \(connect to [^[:space:]]+\[[\.0-9]+\]: (Connection refused|server refused mail service)\)$ -postfix/smtp\[[0-9]+\]: connect to [^[:space:]]+\[[\.0-9]+\]: (Connection (refused|reset by peer|timed out)|read timeout|server (refused mail service|dropped connection)|No route to host) \(port 25\)$ -postfix/smtp\[[0-9]+\]: setting up TLS connection to [^[:space:]]+$ -postfix/smtp\[[0-9]+\]: verify error:num=10:certificate has expired$ -postfix/smtp\[[0-9]+\]: warning: bad size limit "truncates" in EHLO reply from [^[:space:]]+$ -postfix/smtp\[[0-9]+\]: warning: host [^[:space:]]+\[[\.0-9]+\] (greeted me|replied to HELO/EHLO) with my own hostname [^[:space:]]+$ -postfix/smtp\[[0-9]+\]: warning: no MX host for [^[:space:]]+ has a valid A record$ -postfix/smtpd?\[[0-9]+\]: (Unv|V)erified: subject_CN=.*, issuer=.*$ -postfix/smtpd?\[[0-9]+\]: TLS connection established (from|to) [^[:space:]]+: (SSL|TLS)v[123] with cipher [^[:space:]]+ \([0-9/]+ bits\)$ -postfix/smtpd?\[[0-9]+\]: cert has expired$ -postfix/smtpd?\[[0-9]+\]: fingerprint=[0-9A-F:]+$ -postfix/smtpd?\[[0-9]+\]: setting up TLS connection (from|to) [^[:space:]]+\[[\.0-9]+\]$ -postfix/smtpd?\[[0-9]+\]: verify error:num=(10:certificate has expired|18:self signed certificate|19:self signed certificate in certificate chain|20:unable to get local issuer certificate|21:unable to verify the first certificate|26:unsupported certificate purpose|27:certificate not trusted)$ -postfix/smtpd?\[[0-9]+\]: warning: (numeric|malformed) domain name in resource data of MX record for [^[:space:]]+: [^[:space:]]*$ -postfix/smtpd?\[[0-9]+\]: warning: valid_hostname: (empty hostname|invalid character [0-9]+\(decimal\): [^[:space:]]+)$ -postfix/smtpd\[[0-9]+\]: ((dis)?connect|setting up TLS connection|lost connection after AUTH) from [^[:space:]]+\[[\.0-9]+\]$ -postfix/smtpd\[[0-9]+\]: (lost connection|timeout) after [^ ]+ from [^[:space:]]+\[[\.0-9]+\]$ -postfix/smtpd\[[0-9]+\]: SSL_accept error from [^[:space:]]+\[[\.0-9]+\]: 0 -postfix/smtpd\[[0-9]+\]: [0-9]+:error:0407006A:rsa routines:RSA_padding_check_PKCS1_type_1:block type is not 01:rsa_pk1\.c:100: -postfix/smtpd\[[0-9]+\]: [0-9]+:error:1408807A:SSL routines:SSL3_GET_CERT_VERIFY:bad rsa signature:s3_srvr\.c:1833: -postfix/smtpd\[[0-9]+\]: [A-Z0-9]+: [^[:space:]]+\[[\.0-9]+\], sasl_method=PLAIN, sasl_username=[[:alnum:]]+$ -postfix/smtpd\[[0-9]+\]: too many errors after RCPT from [^[:space:]]+\[[\.0-9]+\]$ -postfix/smtpd\[[0-9]+\]: warning: Illegal address syntax from [^[:space:]\[]+\[[\.0-9]+\] in (MAIL|RCPT) command: (<[^>]+>)?$ -postfix/smtpd\[[0-9]+\]: warning: [\.0-9]+: address not listed for hostname [^[:space:]]+$ -postfix/smtpd\[[0-9]+\]: warning: [\.0-9]+: hostname [^[:space:]]+ verification failed: Host name has no address$ -postfix/smtpd\[[0-9]+\]: warning: [^[:space:]]+\[[\.0-9]+\] sent ([^[:space:]]+ header|mail content) instead of SMTP command: .* -postfix/smtpd\[[0-9]+\]: warning: [^[:space:]]+\[[\.0-9]+\]: hostname [^[:space:]]+ verification failed: Host not found$ -postfix/smtpd\[[0-9]+\]: warning: numeric result [\.0-9]+ in address->name lookup for [\.0-9]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/[[:alnum:]]+\[[0-9]+\]: table has changed -- exiting$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/cleanup\[[0-9]+\]: [A-Z0-9]+: message-id=.*$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/cleanup\[[0-9]+\]: warning: premature end-of-input from cleanup socket while reading input attribute name$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/local\[[0-9]+\]: warning: unable to create lock file /var/mail/[[:alnum:]]+\.lock: Permission denied$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/master\[[0-9]+\]: reload configuration$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/n?qmgr\[[0-9]+\]: [A-Z0-9]+: from=<[^,]*>, status=expired, returned to sender$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/n?qmgr\[[0-9]+\]: [A-Z0-9]+: skipped, still being delivered$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/postfix-script: refreshing the Postfix mail system$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtp\[[0-9]+\]: Peer certi?ficate could not be verified$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtp\[[0-9]+\]: SSL_connect error to [^[:space:]]+: -1 +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtp\[[0-9]+\]: [A-Z0-9]+: enabling PIX \. workaround for [^[:space:]]+\[[\.0-9]+\]$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtp\[[0-9]+\]: [^[:space:]]+ status=deferred \(connect to [^[:space:]]+\[[\.0-9]+\]: (Connection refused|server refused mail service)\)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtp\[[0-9]+\]: connect to [^[:space:]]+\[[\.0-9]+\]: (Connection (refused|reset by peer|timed out)|read timeout|server (refused mail service|dropped connection)|No route to host) \(port 25\)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtp\[[0-9]+\]: setting up TLS connection to [^[:space:]]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtp\[[0-9]+\]: verify error:num=10:certificate has expired$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtp\[[0-9]+\]: warning: bad size limit "truncates" in EHLO reply from [^[:space:]]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtp\[[0-9]+\]: warning: host [^[:space:]]+\[[\.0-9]+\] (greeted me|replied to HELO/EHLO) with my own hostname [^[:space:]]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtp\[[0-9]+\]: warning: no MX host for [^[:space:]]+ has a valid A record$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd?\[[0-9]+\]: (Unv|V)erified: subject_CN=.*, issuer=.*$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd?\[[0-9]+\]: TLS connection established (from|to) [^[:space:]]+: (SSL|TLS)v[123] with cipher [^[:space:]]+ \([0-9/]+ bits\)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd?\[[0-9]+\]: cert has expired$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd?\[[0-9]+\]: fingerprint=[0-9A-F:]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd?\[[0-9]+\]: setting up TLS connection (from|to) [^[:space:]]+\[[\.0-9]+\]$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd?\[[0-9]+\]: verify error:num=(10:certificate has expired|18:self signed certificate|19:self signed certificate in certificate chain|20:unable to get local issuer certificate|21:unable to verify the first certificate|26:unsupported certificate purpose|27:certificate not trusted)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd?\[[0-9]+\]: warning: (numeric|malformed) domain name in resource data of MX record for [^[:space:]]+: [^[:space:]]*$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd?\[[0-9]+\]: warning: valid_hostname: (empty hostname|invalid character [0-9]+\(decimal\): [^[:space:]]+)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd\[[0-9]+\]: ((dis)?connect|setting up TLS connection|lost connection after AUTH) from [^[:space:]]+\[[\.0-9]+\]$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd\[[0-9]+\]: (lost connection|timeout) after [^ ]+ from [^[:space:]]+\[[\.0-9]+\]$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd\[[0-9]+\]: SSL_accept error from [^[:space:]]+\[[\.0-9]+\]: 0 +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd\[[0-9]+\]: [0-9]+:error:0407006A:rsa routines:RSA_padding_check_PKCS1_type_1:block type is not 01:rsa_pk1\.c:100: +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd\[[0-9]+\]: [0-9]+:error:1408807A:SSL routines:SSL3_GET_CERT_VERIFY:bad rsa signature:s3_srvr\.c:1833: +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd\[[0-9]+\]: [A-Z0-9]+: [^[:space:]]+\[[\.0-9]+\], sasl_method=PLAIN, sasl_username=[[:alnum:]]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd\[[0-9]+\]: too many errors after RCPT from [^[:space:]]+\[[\.0-9]+\]$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd\[[0-9]+\]: warning: Illegal address syntax from [^[:space:]\[]+\[[\.0-9]+\] in (MAIL|RCPT) command: (<[^>]+>)?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd\[[0-9]+\]: warning: [\.0-9]+: address not listed for hostname [^[:space:]]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd\[[0-9]+\]: warning: [\.0-9]+: hostname [^[:space:]]+ verification failed: Host name has no address$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd\[[0-9]+\]: warning: [^[:space:]]+\[[\.0-9]+\] sent ([^[:space:]]+ header|mail content) instead of SMTP command: .* +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd\[[0-9]+\]: warning: [^[:space:]]+\[[\.0-9]+\]: hostname [^[:space:]]+ verification failed: Host not found$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd\[[0-9]+\]: warning: numeric result [\.0-9]+ in address->name lookup for [\.0-9]+$ # These are only for postfix >= 2.0: -postfix/qmgr\[[0-9]+\]: [A-Z0-9]+: to=<[^,]+, relay=none, delay=[0-9]+, status=deferred \(connect to [^[:space:]]+\[[\.0-9]+\]: server dropped connection without sending the initial greeting\)$ -postfix/smtp\[[0-9]+\]: connect to [^[:space:]]+\[[\.0-9]+\]: server dropped connection without sending the initial greeting \(port 25\)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/qmgr\[[0-9]+\]: [A-Z0-9]+: to=<[^,]+, relay=none, delay=[0-9]+, status=deferred \(connect to [^[:space:]]+\[[\.0-9]+\]: server dropped connection without sending the initial greeting\)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtp\[[0-9]+\]: connect to [^[:space:]]+\[[\.0-9]+\]: server dropped connection without sending the initial greeting \(port 25\)$ diff --git a/logcheck/ignore.d.server/postgresql b/logcheck/ignore.d.server/postgresql index 8587cf7..cbc6d10 100644 --- a/logcheck/ignore.d.server/postgresql +++ b/logcheck/ignore.d.server/postgresql @@ -1,2 +1,2 @@ -postgres\[[0-9]+\]: \[[0-9-]+\] \^ICPU .* sec elapsed .* sec\.$ -postgres\[[0-9]+\]: \[[0-9-]+\] \^ITotal CPU .* sec elapsed .* sec\.$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postgres\[[0-9]+\]: \[[0-9-]+\] \^ICPU .* sec elapsed .* sec\.$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postgres\[[0-9]+\]: \[[0-9-]+\] \^ITotal CPU .* sec elapsed .* sec\.$ diff --git a/logcheck/ignore.d.server/ppp b/logcheck/ignore.d.server/ppp index 48839cb..586c9de 100644 --- a/logcheck/ignore.d.server/ppp +++ b/logcheck/ignore.d.server/ppp @@ -1,9 +1,9 @@ -chat\[[0-9]+\]: abort on \(.*\)$ -chat\[[0-9]+\]: expect \(.*\)$ -chat\[[0-9]+\]: send \(AT.*\^M\)$ -chat\[[0-9]+\]: -- got it$ -chat\[[0-9]+\]: AT.*\^M\^M$ -chat\[[0-9]+\]: \^M$ -chat\[[0-9]+\]: CONNECT$ -chat\[[0-9]+\]: OK$ -chat\[[0-9]+\]: send \(\\d\)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ chat\[[0-9]+\]: abort on \(.*\)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ chat\[[0-9]+\]: expect \(.*\)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ chat\[[0-9]+\]: send \(AT.*\^M\)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ chat\[[0-9]+\]: -- got it$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ chat\[[0-9]+\]: AT.*\^M\^M$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ chat\[[0-9]+\]: \^M$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ chat\[[0-9]+\]: CONNECT$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ chat\[[0-9]+\]: OK$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ chat\[[0-9]+\]: send \(\\d\)$ diff --git a/logcheck/ignore.d.server/proftpd b/logcheck/ignore.d.server/proftpd index 09b752e..6633054 100644 --- a/logcheck/ignore.d.server/proftpd +++ b/logcheck/ignore.d.server/proftpd @@ -1,7 +1,7 @@ -proftpd\[[0-9]+\]: No certificate files found! $ -proftpd\[[0-9]+\]: [^[:space:]]+ ([^[:space:]\[]+\[[\.0-9]\]) - Refused PORT.* (address mismatch)\. $ -proftpd\[[0-9]+\]: [^[:space:]]+ \([^[:space:]\[]+\[[\.0-9]+\]\) - FTP (login timed out|no transfer timeout), disconnected\. $ -proftpd\[[0-9]+\]: [^[:space:]]+ \([^[:space:]\[]+\[[\.0-9]+\]\) - FTP session (closed|opened)\. $ -proftpd\[[0-9]+\]: [^[:space:]]+ \([^[:space:]\[]+\[[\.0-9]+\]\) - USER [^[:space:]]+: (Login successful\.|no such user found from .*\[[\.0-9]+\] to [\.0-9]+:21) $ -proftpd\[[0-9]+\]: [^[:space:]]+ \([^[:space:]\[]+\[[\.0-9]+\]\) - no such user '[^[:space:]]+' $ -proftpd\[[0-9]+\]: connect from [\.0-9]+ $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ proftpd\[[0-9]+\]: No certificate files found! $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ proftpd\[[0-9]+\]: [^[:space:]]+ ([^[:space:]\[]+\[[\.0-9]\]) - Refused PORT.* (address mismatch)\. $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ proftpd\[[0-9]+\]: [^[:space:]]+ \([^[:space:]\[]+\[[\.0-9]+\]\) - FTP (login timed out|no transfer timeout), disconnected\. $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ proftpd\[[0-9]+\]: [^[:space:]]+ \([^[:space:]\[]+\[[\.0-9]+\]\) - FTP session (closed|opened)\. $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ proftpd\[[0-9]+\]: [^[:space:]]+ \([^[:space:]\[]+\[[\.0-9]+\]\) - USER [^[:space:]]+: (Login successful\.|no such user found from .*\[[\.0-9]+\] to [\.0-9]+:21) $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ proftpd\[[0-9]+\]: [^[:space:]]+ \([^[:space:]\[]+\[[\.0-9]+\]\) - no such user '[^[:space:]]+' $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ proftpd\[[0-9]+\]: connect from [\.0-9]+ $ diff --git a/logcheck/ignore.d.server/rpld b/logcheck/ignore.d.server/rpld index 2dc6889..57243c9 100644 --- a/logcheck/ignore.d.server/rpld +++ b/logcheck/ignore.d.server/rpld @@ -1 +1 @@ -rpld\[[0-9]+\]: client [:a-f0-9]+ requested block [\.0-9]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ rpld\[[0-9]+\]: client [:a-f0-9]+ requested block [\.0-9]+$ diff --git a/logcheck/ignore.d.server/samba b/logcheck/ignore.d.server/samba index 868d988..7888b6f 100644 --- a/logcheck/ignore.d.server/samba +++ b/logcheck/ignore.d.server/samba @@ -1,2 +1,2 @@ -smbd\[[0-9]+\]: read(_socket)?_data: (read|recv) failure for 4\. Error = (No route to host|Connection reset by peer)$ -smbd\[[0-9]+\]: \[[/0-9]+ [0-9:]+, [0-9]+\] lib/util_sock.c:read(_socket)?_data\([0-9]+\)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ smbd\[[0-9]+\]: read(_socket)?_data: (read|recv) failure for 4\. Error = (No route to host|Connection reset by peer)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ smbd\[[0-9]+\]: \[[/0-9]+ [0-9:]+, [0-9]+\] lib/util_sock.c:read(_socket)?_data\([0-9]+\)$ diff --git a/logcheck/ignore.d.server/sfs-client b/logcheck/ignore.d.server/sfs-client index 1e77a09..5200627 100644 --- a/logcheck/ignore.d.server/sfs-client +++ b/logcheck/ignore.d.server/sfs-client @@ -1,2 +1,2 @@ -: nfsmounter: mounted /sfs/\.linuxmnt/[^[:blank:]]+:[0-9a-z]+/r$ -: sfsrwcd: [^[:blank:]]+:[0-9a-z]+ deleted$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ : nfsmounter: mounted /sfs/\.linuxmnt/[^[:blank:]]+:[0-9a-z]+/r$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ : sfsrwcd: [^[:blank:]]+:[0-9a-z]+ deleted$ diff --git a/logcheck/ignore.d.server/sfs-server b/logcheck/ignore.d.server/sfs-server index 055b1ad..95875fb 100644 --- a/logcheck/ignore.d.server/sfs-server +++ b/logcheck/ignore.d.server/sfs-server @@ -1,2 +1,2 @@ -: sfsauthd: serving [^:]+:[0-9a-z]+$ -: sfssd: accepted connection from [\.0-9]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ : sfsauthd: serving [^:]+:[0-9a-z]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ : sfssd: accepted connection from [\.0-9]+$ diff --git a/logcheck/ignore.d.server/spamassassin b/logcheck/ignore.d.server/spamassassin index 650f47b..c1ed42b 100644 --- a/logcheck/ignore.d.server/spamassassin +++ b/logcheck/ignore.d.server/spamassassin @@ -1,5 +1,5 @@ -spamd\[[0-9]+\]: Creating default_prefs -spamd\[[0-9]+\]: connection from .* at port -spamd\[[0-9]+\]: clean message for -spamd\[[0-9]+\]: identified spam for -spamd\[[0-9]+\]: skipped large message in +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ spamd\[[0-9]+\]: Creating default_prefs +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ spamd\[[0-9]+\]: connection from .* at port +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ spamd\[[0-9]+\]: clean message for +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ spamd\[[0-9]+\]: identified spam for +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ spamd\[[0-9]+\]: skipped large message in diff --git a/logcheck/ignore.d.server/squid b/logcheck/ignore.d.server/squid index 02ad6aa..5295f0c 100644 --- a/logcheck/ignore.d.server/squid +++ b/logcheck/ignore.d.server/squid @@ -1,10 +1,10 @@ -squid\[[0-9]+\]: Finished. Wrote [0-9]+ entries\. $ -squid\[[0-9]+\]: Took [\.0-9]+ seconds \( *[\.0-9]+ entries/sec\)\. $ -squid\[[0-9]+\]: (Closing Pinger socket|Pinger socket opened) on FD [0-9]+$ -squid\[[0-9]+\]: (access|store)LogRotate: Rotating(\.)?$ -squid\[[0-9]+\]: NETDB state saved;$ -squid\[[0-9]+\]: helperOpenServers: Starting [0-9]+ '.*' processes -squid\[[0-9]+\]: logfileRotate: /var/log/squid/(access|store).log $ -squid\[[0-9]+\]: sslReadServer: FD [0-9]+: read failure: \(104\) Connection reset by peer $ -squid\[[0-9]+\]: storeDirWriteCleanLogs: Starting\.\.\. $ -squid\[[0-9]+\]: urlParse: Illegal character in hostname '[^']+' $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ squid\[[0-9]+\]: Finished. Wrote [0-9]+ entries\. $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ squid\[[0-9]+\]: Took [\.0-9]+ seconds \( *[\.0-9]+ entries/sec\)\. $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ squid\[[0-9]+\]: (Closing Pinger socket|Pinger socket opened) on FD [0-9]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ squid\[[0-9]+\]: (access|store)LogRotate: Rotating(\.)?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ squid\[[0-9]+\]: NETDB state saved;$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ squid\[[0-9]+\]: helperOpenServers: Starting [0-9]+ '.*' processes +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ squid\[[0-9]+\]: logfileRotate: /var/log/squid/(access|store).log $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ squid\[[0-9]+\]: sslReadServer: FD [0-9]+: read failure: \(104\) Connection reset by peer $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ squid\[[0-9]+\]: storeDirWriteCleanLogs: Starting\.\.\. $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ squid\[[0-9]+\]: urlParse: Illegal character in hostname '[^']+' $ diff --git a/logcheck/ignore.d.server/ssh b/logcheck/ignore.d.server/ssh index f8a7e6c..d64d593 100644 --- a/logcheck/ignore.d.server/ssh +++ b/logcheck/ignore.d.server/ssh @@ -1,11 +1,11 @@ -sshd\[[0-9]+\]: syslogin_perform_logout: logout\(\) returned an error$ -sshd\[[0-9]+\]: Could not reverse map address .*\. -sshd\[[0-9]+\]: Connection closed by .* -sshd\[[0-9]+\]: Did not receive ident(ification)? string from [\.0-9]+$ -sshd\[[0-9]+\]: scanned from [\.0-9]+ with SSH-1\.0-SSH_Version_Mapper\. Don't panic\.$ -sshd\[[0-9]+\]: Disconnecting: Your ssh version is too old and is no longer supported\. Please install a newer version\.$ -sshd\[[0-9]+\]: Accepted (keyboard-interactive|password|publickey) for [[:alnum:]]+ from [\.0-9]+ port [0-9]+( ssh2)?$ -sshd\[[0-9]+\]: warning: /etc/hosts.deny, line 15: can't verify hostname: gethostbyname(.*) failed -sshd\[[0-9]+\]: refused connect from .* -sshd\[[0-9]+\]: Received disconnect from [\.0-9]+: 11: Disconnect requested by Windows SSH Client.$ -sshd\[[0-9]+\]: subsystem request for sftp$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: syslogin_perform_logout: logout\(\) returned an error$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: Could not reverse map address .*\. +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: Connection closed by .* +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: Did not receive ident(ification)? string from [\.0-9]+$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: scanned from [\.0-9]+ with SSH-1\.0-SSH_Version_Mapper\. Don't panic\.$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: Disconnecting: Your ssh version is too old and is no longer supported\. Please install a newer version\.$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: Accepted (keyboard-interactive|password|publickey) for [[:alnum:]]+ from [\.0-9]+ port [0-9]+( ssh2)?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: warning: /etc/hosts.deny, line 15: can't verify hostname: gethostbyname(.*) failed +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: refused connect from .* +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: Received disconnect from [\.0-9]+: 11: Disconnect requested by Windows SSH Client.$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: subsystem request for sftp$ diff --git a/logcheck/ignore.d.server/ssmtp b/logcheck/ignore.d.server/ssmtp index 462187c..677810e 100644 --- a/logcheck/ignore.d.server/ssmtp +++ b/logcheck/ignore.d.server/ssmtp @@ -1 +1 @@ -sSMTP mail\[[0-9]+\]: .* sent mail for root +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sSMTP mail\[[0-9]+\]: .* sent mail for root diff --git a/logcheck/ignore.d.server/sysklogd b/logcheck/ignore.d.server/sysklogd index 767efb5..e8c555a 100644 --- a/logcheck/ignore.d.server/sysklogd +++ b/logcheck/ignore.d.server/sysklogd @@ -1 +1 @@ -syslogd [\.#0-9]+: restart \(remote reception\)\.$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ syslogd [\.#0-9]+: restart \(remote reception\)\.$ diff --git a/logcheck/ignore.d.server/tftpd b/logcheck/ignore.d.server/tftpd index 887c704..f6631fc 100644 --- a/logcheck/ignore.d.server/tftpd +++ b/logcheck/ignore.d.server/tftpd @@ -1,2 +1,2 @@ -in\.tftpd\[[0-9]+\]: RRQ from [\.0-9]+ filename [^[:space:]]+ $ -in\.tftpd\[[0-9]+\]: tftp: client does not accept options +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ in\.tftpd\[[0-9]+\]: RRQ from [\.0-9]+ filename [^[:space:]]+ $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ in\.tftpd\[[0-9]+\]: tftp: client does not accept options diff --git a/logcheck/ignore.d.server/tmp b/logcheck/ignore.d.server/tmp index 15e33c5..9dd06e3 100644 --- a/logcheck/ignore.d.server/tmp +++ b/logcheck/ignore.d.server/tmp @@ -1,99 +1,99 @@ ## imp -IMP\[[0-9]+\]: FAILED .* to .*:143 as .* +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ IMP\[[0-9]+\]: FAILED .* to .*:143 as .* ## libpam-modules -PAM_unix\[[0-9]+\]: authentication failure; \(uid=0\) -> .* for (imap|netatalk|pop|samba|ssh) service -PAM_unix\[[0-9]+\]: check pass; user unknown$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ PAM_unix\[[0-9]+\]: authentication failure; \(uid=0\) -> .* for (imap|netatalk|pop|samba|ssh) service +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ PAM_unix\[[0-9]+\]: check pass; user unknown$ # old-style pam entries (no longer provided by logcheck but needed on woody) -PAM_.*: .* session (opened|closed) for user .* +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ PAM_.*: .* session (opened|closed) for user .* ## netatalk -afpd\[[0-9]+\]: [^[:space:]]+: E:AFPDaemon: bad function 7A -afpd\[[0-9]+\]: afp_getsrvrparms: stat /volumes/(km/kmstab/kmstab|kp/kp/kp(/kp|/kpstab|stab/kpstab)|misc/flstab/flstab): Permission denied -afpd\[[0-9]+\]: uams_dhx_pam\.c :PAM: (PAM Auth OK!|Success -- .*|User entered a null value -- .*) -afpd\[[0-9]+\]: uams_dhx_pam\.c :PAM: PAM_Error: Authentication failure -- (Bad file descriptor|Invalid argument) -afpd\[[0-9]+\]: uams_dhx_pam\.c :PAM: User entered a null value -- No such file or directory -atalkd\[[0-9]+\]: as_timer sendto: Netvaerket er ikke tilgaengeligt +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: [^[:space:]]+: E:AFPDaemon: bad function 7A +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: afp_getsrvrparms: stat /volumes/(km/kmstab/kmstab|kp/kp/kp(/kp|/kpstab|stab/kpstab)|misc/flstab/flstab): Permission denied +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: uams_dhx_pam\.c :PAM: (PAM Auth OK!|Success -- .*|User entered a null value -- .*) +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: uams_dhx_pam\.c :PAM: PAM_Error: Authentication failure -- (Bad file descriptor|Invalid argument) +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ afpd\[[0-9]+\]: uams_dhx_pam\.c :PAM: User entered a null value -- No such file or directory +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ atalkd\[[0-9]+\]: as_timer sendto: Netvaerket er ikke tilgaengeligt ## hylafax-server -FaxGetty\[[0-9]+\]: ANSWER: Can not lock modem device -gnome-name-server\[[0-9]+\]: server_is_alive: .* +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ FaxGetty\[[0-9]+\]: ANSWER: Can not lock modem device +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ gnome-name-server\[[0-9]+\]: server_is_alive: .* ## uw-imap -i(map|pop3)d\[[0-9]+\]: (AUTHENTICATE (LOGIN|PLAIN) failure|Login failed)( user=.*)? host=(.* )?\[.*\] +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ i(map|pop3)d\[[0-9]+\]: (AUTHENTICATE (LOGIN|PLAIN) failure|Login failed)( user=.*)? host=(.* )?\[.*\] ## ppp -ipppd\[[0-9]+\]: Connect\[0\]: /dev/ippp[0-9], fd: 12 +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ipppd\[[0-9]+\]: Connect\[0\]: /dev/ippp[0-9], fd: 12 ## misc -kernel: Disorder[0-9] [0-9] [0-9] f[0-9] s[0-9] rr[0-9] -kernel: IP_MASQ:reverse ICMP: failed checksum from .*! -kernel: OPEN: [\.0-9]* -> [\.0-9]* UDP, port: [0-9]* -> [0-9]* -kernel: Packet log: input DENY eth1 PROTO=1 0.0.0.0:5 10.0.0.40:1 L=427 S=0xD0 I=0 F=0x4000 T=255 \(#22\) -kernel: Shorewall:net2all:DROP:.*$ -kernel: lp[0-9]: compatibility mode -kernel: Undo( partial)? (Hoe|loss|retrans) -printer: offline or intervention needed +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: Disorder[0-9] [0-9] [0-9] f[0-9] s[0-9] rr[0-9] +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: IP_MASQ:reverse ICMP: failed checksum from .*! +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: OPEN: [\.0-9]* -> [\.0-9]* UDP, port: [0-9]* -> [0-9]* +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: Packet log: input DENY eth1 PROTO=1 0.0.0.0:5 10.0.0.40:1 L=427 S=0xD0 I=0 F=0x4000 T=255 \(#22\) +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: Shorewall:net2all:DROP:.*$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: lp[0-9]: compatibility mode +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: Undo( partial)? (Hoe|loss|retrans) +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ printer: offline or intervention needed ## Printer and Windows PC at Homebase ignoring change of DHCP (192.168.101 -> 192.168.1) -kernel: Shorewall:all2all:REJECT:.*SRC=192.168.103.17 DST=192.168.101.2 .*$ -kernel: Shorewall:all2all:REJECT:.*SRC=192.168.103.248 DST=192.168.101.22 .*$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: Shorewall:all2all:REJECT:.*SRC=192.168.103.17 DST=192.168.101.2 .*$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: Shorewall:all2all:REJECT:.*SRC=192.168.103.248 DST=192.168.101.22 .*$ ## Non-UDMA hd cable -kernel: hda: status timeout: status=0xd0 \{ Busy \} -kernel: hda: no DRQ after issuing WRITE -kernel: ide0: reset: success +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: hda: status timeout: status=0xd0 \{ Busy \} +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: hda: no DRQ after issuing WRITE +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: ide0: reset: success ## Postfix SASL not working -postfix/smtpd\[[0-9]+\]: unable to open Berkeley db /etc/sasldb: No such file or directory +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd\[[0-9]+\]: unable to open Berkeley db /etc/sasldb: No such file or directory ## ntp-simple -ntpd\[[0-9]+\]: synchronisation lost -ntpd\[[0-9]+\]: synchronisation lost -ntpd\[[0-9]+\]: time reset [\.0-9-]* . -ntpd\[[0-9]+\]: time reset [\.0-9-]+ s +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: synchronisation lost +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: synchronisation lost +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: time reset [\.0-9-]* . +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: time reset [\.0-9-]+ s ## portsentry -portsentry\[[0-9]+\]: attackalert: .* +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ portsentry\[[0-9]+\]: attackalert: .* ## pump -pumpd\[[0-9]+\]: SO_BINDTODEVICE eth0 \(4\) failed: Invalid argument +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pumpd\[[0-9]+\]: SO_BINDTODEVICE eth0 \(4\) failed: Invalid argument ## samba -smbd\[[0-9]+\]: process_local_message: unknown UDP message command code \([0-9a-f]+\) - ignoring. $ -smbd\[[0-9]+\]: read(_socket)?_data: (read|recv) failure for 4\. Error = (No route to host|Connection (reset by peer|timed out)) $ -smbd\[[0-9]+\]: smb_pam_passcheck: PAM: smb_pam_auth failed - Rejecting User [[:alnum:]]+ ! $ -smbd\[[0-9]+\]: yield_connection: tdb_delete for name failed with error Record does not exist\. $ -smbd\[[0-9]+\]: [^[:space:]]+ \([\.0-9]+\) couldn't find service c $ -smbd\[[0-9]+\]: api_srv_net_share_add: Failed to unmarshall SRV_Q_NET_SHARE_ADD. $ -smbd\[[0-9]+\]: prs_mem_get: reading data of size 4 would overrun buffer. $ -smbd\[[0-9]+\]: \[[0-9/]+ [0-9:]+, [0-9]+\] (lib/util_sock.c:read_data|passdb/pampass.c:smb_pam_passcheck|rpc_parse/parse_prs.c:prs_mem_get|rpc_server/srv_(pipe.c:api_rpcTNP|srvsvc.c:api_srv_net_share_add))\([0-9]+\) $ -smbd\[[0-9]+\]: \[[0-9/]+ [0-9:]+, [0-9]+\] smbd/(connection.c:yield_connection|oplock.c:process_local_message|service.c:(find_service|make_connection))\([0-9]+\) $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ smbd\[[0-9]+\]: process_local_message: unknown UDP message command code \([0-9a-f]+\) - ignoring. $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ smbd\[[0-9]+\]: read(_socket)?_data: (read|recv) failure for 4\. Error = (No route to host|Connection (reset by peer|timed out)) $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ smbd\[[0-9]+\]: smb_pam_passcheck: PAM: smb_pam_auth failed - Rejecting User [[:alnum:]]+ ! $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ smbd\[[0-9]+\]: yield_connection: tdb_delete for name failed with error Record does not exist\. $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ smbd\[[0-9]+\]: [^[:space:]]+ \([\.0-9]+\) couldn't find service c $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ smbd\[[0-9]+\]: api_srv_net_share_add: Failed to unmarshall SRV_Q_NET_SHARE_ADD. $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ smbd\[[0-9]+\]: prs_mem_get: reading data of size 4 would overrun buffer. $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ smbd\[[0-9]+\]: \[[0-9/]+ [0-9:]+, [0-9]+\] (lib/util_sock.c:read_data|passdb/pampass.c:smb_pam_passcheck|rpc_parse/parse_prs.c:prs_mem_get|rpc_server/srv_(pipe.c:api_rpcTNP|srvsvc.c:api_srv_net_share_add))\([0-9]+\) $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ smbd\[[0-9]+\]: \[[0-9/]+ [0-9:]+, [0-9]+\] smbd/(connection.c:yield_connection|oplock.c:process_local_message|service.c:(find_service|make_connection))\([0-9]+\) $ ## ssh -sshd\[[0-9]+\]: Failed password for [[:alnum:]]+ from [0-9\.]+ port [0-9]+ ssh2$ -sshd\[[0-9]+\]: packet_set_maxsize: setting to 4096 $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: Failed password for [[:alnum:]]+ from [0-9\.]+ port [0-9]+ ssh2$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: packet_set_maxsize: setting to 4096 $ ## postfix -postfix.*\[[0-9]+\]: .* from= -postfix/smtpd\[[0-9]+\]: warning: Illegal address syntax from [\.[:alnum:]-]+\[[\.0-9]+\] in MAIL command: +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix.*\[[0-9]+\]: .* from= +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd\[[0-9]+\]: warning: Illegal address syntax from [\.[:alnum:]-]+\[[\.0-9]+\] in MAIL command: ## Tulle getting spammed -tulle postfix/smtpd\[[0-9]+\]: too many errors after RCPT from unknown\[\.0-9]+[\] -rpc.mountd: authenticated mount request from .* for .* +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ tulle postfix/smtpd\[[0-9]+\]: too many errors after RCPT from unknown\[\.0-9]+[\] +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ rpc.mountd: authenticated mount request from .* for .* ## snort -snort: .*FrontPage -snort: IDS015 - RPC - portmap-request-status: -snort: IDS029 - SCAN-Possible Queso Fingerprint attempt: -snort: IDS115 - MISC-Traceroute-UDP: -snort: IDS212 - MISC - DNS Zone Transfer: -snort: IDS226 - CVE-1999-0172 - CGI-formmail: -snort: IDS246 - MISC - Large ICMP Packet: -snort: IIS- -snort: MISC-Attempted Sun RPC high port access: -snort: NETBIOS-SMB-C: -snort: NETBIOS-SMB-CD...: -snort: NMAP TCP ping!: -snort: RPC Info Query: -snort: SCAN-SYN FIN: -snort: spp_http_decode: IIS Unicode attack detected: -snort: spp_portscan: End of portscan -snort: spp_portscan: PORTSCAN DETECTED -snort: spp_portscan: portscan status from -snort: WEB-../..: -snort: WEB-CGI-upload.pl: +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ snort: .*FrontPage +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ snort: IDS015 - RPC - portmap-request-status: +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ snort: IDS029 - SCAN-Possible Queso Fingerprint attempt: +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ snort: IDS115 - MISC-Traceroute-UDP: +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ snort: IDS212 - MISC - DNS Zone Transfer: +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ snort: IDS226 - CVE-1999-0172 - CGI-formmail: +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ snort: IDS246 - MISC - Large ICMP Packet: +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ snort: IIS- +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ snort: MISC-Attempted Sun RPC high port access: +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ snort: NETBIOS-SMB-C: +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ snort: NETBIOS-SMB-CD...: +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ snort: NMAP TCP ping!: +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ snort: RPC Info Query: +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ snort: SCAN-SYN FIN: +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ snort: spp_http_decode: IIS Unicode attack detected: +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ snort: spp_portscan: End of portscan +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ snort: spp_portscan: PORTSCAN DETECTED +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ snort: spp_portscan: portscan status from +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ snort: WEB-../..: +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ snort: WEB-CGI-upload.pl: ## postgres -postgres\[[0-9]+\]: \[[0-9-]+\] DEBUG: .* -postgres\[[0-9]+\]: \[[0-9-]+\] LOG: connection received: host=\[local\]$ -postgres\[[0-9]+\]: \[[0-9-]+\] LOG: connection authorized: user=postgres database=template1 -postgres\[[0-9]+\]: \[[0-9-]+\] Re-using: Free/Avail. Space .* EndEmpty/Avail\. Pages .* CPU .* sec\. -postgres\[[0-9]+\]: \[[0-9-]+\] [0-9]*; Re-using: Free/Avail. Space .* EndEmpty/Avail\. Pages .* CPU .* sec\. +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postgres\[[0-9]+\]: \[[0-9-]+\] DEBUG: .* +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postgres\[[0-9]+\]: \[[0-9-]+\] LOG: connection received: host=\[local\]$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postgres\[[0-9]+\]: \[[0-9-]+\] LOG: connection authorized: user=postgres database=template1 +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postgres\[[0-9]+\]: \[[0-9-]+\] Re-using: Free/Avail. Space .* EndEmpty/Avail\. Pages .* CPU .* sec\. +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postgres\[[0-9]+\]: \[[0-9-]+\] [0-9]*; Re-using: Free/Avail. Space .* EndEmpty/Avail\. Pages .* CPU .* sec\. ## amavis -amavis\[[0-9]+\]: warning - MIME::Parser error: .* +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ amavis\[[0-9]+\]: warning - MIME::Parser error: .* ## Misc entries on Gibraltar (using older logcheck and syslog...) --- MARK -- $ -/USR/SBIN/CRON\[[0-9]+\]: \(root\) CMD \(test -x /usr/sbin/logcheck && nice -n10 /usr/sbin/logcheck\) $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ -- MARK -- $ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ /USR/SBIN/CRON\[[0-9]+\]: \(root\) CMD \(test -x /usr/sbin/logcheck && nice -n10 /usr/sbin/logcheck\) $ diff --git a/logcheck/ignore.d.server/ucd-snmp b/logcheck/ignore.d.server/ucd-snmp index 56f0db5..af20c76 100644 --- a/logcheck/ignore.d.server/ucd-snmp +++ b/logcheck/ignore.d.server/ucd-snmp @@ -1 +1 @@ -ucd-snmp\[[0-9]+\]: Connection from .* +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ucd-snmp\[[0-9]+\]: Connection from .* diff --git a/logcheck/ignore.d.server/uptimed b/logcheck/ignore.d.server/uptimed index ff20f9e..7cc4782 100644 --- a/logcheck/ignore.d.server/uptimed +++ b/logcheck/ignore.d.server/uptimed @@ -1 +1 @@ -uptimed: moving up to position [0-9]+: [0-9]+ days, [0-9:]+ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ uptimed: moving up to position [0-9]+: [0-9]+ days, [0-9:]+ -- cgit v1.2.3