summaryrefslogtreecommitdiff
path: root/logcheck/ignore.d.server/local
blob: 48a302c6c8724a7f353ff1a6c6ea51d8e735ce5d (plain) 
    

  1. ### ignore.d.server/amanda
    2. 

  2. amandad\[[0-9]+\]: connect from
    3. 

  3. ### ignore.d.server/amavis
    4. 

  4. amavis\[[0-9]+\]: infected \([^[:space:]]+\), from=<[^[:space:]]+>, to=<[^[:space:]]+>, quarantine virus-[0-9-]+
    5. 

  5. amavis\[[0-9]+\]: local delivery: <[^[:space:]]+> -> <(spam|virus)-quarantine>, mbx=/var/lib/amavis/virusmails/(spam|virus)-[[:alnum:]-]+(\.gz)?
    6. 

  6. amavis\[[0-9]+\]: mail checking ended: (DISCARD|REJECT)
    7. 

  7. amavis\[[0-9]+\]: spam from=<[^[:space:]]+>, to=<[^[:space:]]+>, quarantine spam-[^[:space:]]+
    8. 

  8. amavis\[[0-9]+\]: spam_scan: Yes, hits=[\.0-9]+ tests=[^[:space:]]+ <[^[:space:]]+>
    9. 

  9. amavis\[[0-9]+\]: warning - MIME::Parser error: .*
    10. 

  10. ### ignore.d.server/anacron
    11. 

  11. anacron\[[0-9]+\]: Job `cron.(daily|weekly|monthly)' terminated( \(exit status: 1\))?( \(mailing output\))?
    12. 

  12. anacron\[[0-9]+\]: Normal exit
    13. 

  13. anacron\[[0-9]+\]: Anacron 2.3 started on [0-9-]+
    14. 

  14. anacron\[[0-9]+\]: Will run job `cron.(daily|weekly|monthly)' in (5|10|15) min\.
    15. 

  15. anacron\[[0-9]+\]: Jobs will be executed sequentially
    16. 

  16. anacron\[[0-9]+\]: Job `cron.(daily|weekly|monthly)' started
    17. 

  17. anacron\[[0-9]+\]: Updated timestamp for job `cron.(daily|weekly|monthly)' to [0-9-]+
    18. 

  18. ### ignore.d.server/bind
    19. 

  19. named\[[0-9]+\]: .*: query\(.*\) NS points to CNAME \(.*\)
    20. 

  20. named\[[0-9]+\]: NSTATS [0-9]+ [0-9]+
    21. 

  21. named\[[0-9]+\]: .* All possible .* lame
    22. 

  22. named\[[0-9]+\]: sysquery: query\(.*\) No possible A RRs
    23. 

  23. named\[[0-9]+\]: client .*: transfer of '.*': AXFR started
    24. 

  24. named\[[0-9]+\]: zone .*/IN: transfered serial [0-9]+
    25. 

  25. named\[[0-9]+\]: transfer of '.*/IN' from .*: end of transfer
    26. 

  26. named\[[0-9]+\]: zone .*/IN: sending notifies \(serial [0-9]+\)
    27. 

  27. named\[[0-9]+\]: rcvd NOTIFY\(.*, IN, SOA\) from \[.*\]\.[0-9]+
    28. 

  28. named\[[0-9]+\]: late CNAME in answer section for .*
    29. 

  29. ### ignore.d.server/bind.tmp
    30. 

  30. named\[[0-9]+\]: zone .*: refresh: failure trying master .*: timed out
    31. 

  31. named\[[0-9]+\]: client [\.0-9]+#[0-9]+: update forwarding denied
    32. 

  32. ### ignore.d.server/courier
    33. 

  33. courierpop3login: Connection, ip=\[::ffff:.*\]
    34. 

  34. courierpop3login: LOGIN, user=.*, ip=\[::ffff:.*\]
    35. 

  35. courierpop3login: LOGOUT, user=.*, ip=\[::ffff:.*\], top=.* retr=.*
    36. 

  36. courierpop3login: Disconnected, ip=\[::ffff:.*\]
    37. 

  37. courierpop3login: TIMEOUT, user=.*, ip=\[::ffff:.*\], top=0, retr=0
    38. 

  38. pop3d-ssl: Connection, ip=\[::ffff:.*\]
    39. 

  39. pop3d-ssl: LOGIN, user=.*, ip=\[::ffff:.*\]
    40. 

  40. pop3d-ssl: LOGOUT, user=.*, ip=\[::ffff:.*\], top=.*, retr=.*
    41. 

  41. pop3d-ssl: TIMEOUT, user=.*, ip=\[::ffff:.*\],top=.*, retr=.*
    42. 

  42. imaplogin: Connection, ip=\[::ffff:.*\]
    43. 

  43. imaplogin: LOGIN, user=.*, ip=\[::ffff:.*\]
    44. 

  44. imaplogin: LOGOUT, user=.*, ip=\[::ffff:.*\], headers=.* body=.*
    45. 

  45. imaplogin: DISCONNECTED, user=.*, ip=\[::ffff:.*\].*
    46. 

  46. imapd-ssl: LOGOUT, user=.*, ip=\[::ffff:.*\], headers=.* body=.*
    47. 

  47. imapd-ssl: Connection, ip=\[::ffff:.*\]
    48. 

  48. imapd-ssl: LOGIN, user=.*, ip=\[::ffff:.*\]
    49. 

  49. imapd-ssl: DISCONNECTED, user=.*, ip=\[::ffff:.*\]
    50. 

  50. ### ignore.d.server/dancer-ircd
    51. 

  51. ircd\[[0-9]+\]: ircd exiting: autodie
    52. 

  52. ircd\[[0-9]+\]: Server Ready
    53. 

  53. (ircd\[[0-9]+\]: )?binding stream socket [\.[:alnum:]]+\[\*\.666[789]\]: Address already in use
    54. 

  54. ### ignore.d.server/dhcp-client
    55. 

  55. dhclient(-2.2.x)?: DHCP(REQUEST|DISCOVER) on .* to .* port 67( interval [0-9]+)?
    56. 

  56. dhclient(-2.2.x)?: DHCP(ACK|OFFER) from [\.0-9]+
    57. 

  57. dhclient(-2.2.x)?: bound to .* -- renewal in [0-9]+ seconds\.
    58. 

  58. dhclient(-2.2.x)?: irda0: unknown hardware address type 783
    59. 

  59. ### ignore.d.server/dhcp.changes
    60. 

  60. # NB: dhcp3 entries are in dhcp3-common
    61. 

  61. dhcpd-2.2.x: Abandoning IP address [\.0-9]+: pinged before offer
    62. 

  62. dhcpd-2.2.x: DHCPRELEASE of [\.0-9]+ from [:0-9a-e]+ via eth[0-9]+ \(found\)
    63. 

  63. dhcpd-2.2.x: DHCPREQUEST for .* from .* via
    64. 

  64. dhcpd-2.2.x: DHCPACK on .* to .* via
    65. 

  65. dhcpd-2.2.x: DHCPDISCOVER from .* via
    66. 

  66. dhcpd-2.2.x: DHCPOFFER on .* to .* via
    67. 

  67. dhcpd-2.2.x: BOOTREQUEST from [:0-9a-f]+
    68. 

  68. ### ignore.d.server/dhcp3-common
    69. 

  69. dhcpd: Abandoning IP address [\.0-9]+: pinged before offer
    70. 

  70. dhcpd: BOOTREQUEST from
    71. 

  71. dhcpd: DHCPACK on [\.0-9]+ to [:0-9a-f]+ via
    72. 

  72. dhcpd: DHCPACK to [\.0-9]+
    73. 

  73. dhcpd: DHCPDISCOVER from [:0-9a-f]+ via
    74. 

  74. dhcpd: DHCPINFORM from
    75. 

  75. dhcpd: DHCPNAK on
    76. 

  76. dhcpd: DHCPOFFER on [\.0-9]+ to [:0-9a-f]+ via
    77. 

  77. dhcpd: DHCPRELEASE of [\.0-9]+
    78. 

  78. dhcpd: DHCPREQUEST for [\.0-9]+ from [:0-9a-f]+ via
    79. 

  79. dhcpd: ICMP Echo reply while lease [\.0-9]+ valid.
    80. 

  80. dhcpd: Wrote [0-9]+ (leases|deleted host decls|new dynamic host decls) to leases file\.
    81. 

  81. dhcpd: accepting packet with data after udp payload.
    82. 

  82. dhcpd: ip length 576 disagrees with bytes received 590.
    83. 

  83. ### ignore.d.server/gdm
    84. 

  84. gdm\[[0-9]+\]: run_pictures: .*/.gnome/gdm .*\.
    85. 

  85. ### ignore.d.server/gdm.da_DK
    86. 

  86. gdm\[[0-9]+\]: Pingning af.* mislykkedes, deaktiver terminal!
    87. 

  87. gdm\[[0-9]+\]: gdm_slave_xioerror_handler: Fatal X-fejl - genstarter.*
    88. 

  88. 

  89. ### ignore.d.server/hotplug
    90. 

  90. /etc/hotplug/net.agent: invoke if(up|down) ppp[0-9]
    91. 

  91. /etc/hotplug/net.agent: assuming ppp[0-9] is already up
    92. 

  92. ### ignore.d.server/hylafax-server
    93. 

  93. Fax(Getty|Send)\[[0-9]+\]: STATE CHANGE:( ->| BASE| LOCKWAIT| LISTENING| RUNNING| ANSWERING| RECEIVING| MODEMWAIT)+
    94. 

  94. Fax(Getty|Send)\[[0-9]+\]: MODEM (ROCKWELL|ZYXEL) .*
    95. 

  95. FaxGetty\[[0-9]+\]: RECV FAX \([0-9]+\): from .*, page .* in [0-9]+:[0-9]+, INF, .* line/mm, (1|2)-D MR(, [0-9]+ bit/s)?
    96. 

  96. FaxGetty\[[0-9]+\]: RECV FAX \([0-9]+\): recvq/fax[0-9]+\.tif from .*, route to .*, [0-9]+ pages in [0-9]+:[0-9]+
    97. 

  97. FaxGetty\[[0-9]+\]: RECV FAX: bin/faxrcvd "recvq/fax[0-9]+\.tif" "ttyS[012]" "[0-9]+" ""
    98. 

  98. FaxGetty\[[0-9]+\]: ANSWER: Ring detected without successful handshake
    99. 

  99. FaxGetty\[[0-9]+\]: ANSWER: FAX CONNECTION
    100. 

  100. FaxQueuer\[[0-9]+\]: SUBMIT JOB [0-9]+
    101. 

  101. FaxSend\[[0-9]+\]: SEND FAX: JOB [0-9]+ DEST [0-9]+ COMMID [0-9]+
    102. 

  102. HylaFAX\[[0-9]+\]: Filesystem has SysV-style file creation semantics.
    103. 

  103. ### ignore.d.server/imp
    104. 

  104. IMP\[[0-9]+\]: Login .* to .*:143 as .*
    105. 

  105. ### ignore.d.server/libgpmg1
    106. 

  106. [[:alnum:]]: /dev/gpmctl: No such file or directory
    107. 

  107. ### ignore.d.server/libpam-modules
    108. 

  108. pam_limits\[[0-9]+\]: default limits skipped for 'root'
    109. 

  109. ### ignore.d.server/mailutils-imap4d
    110. 

  110. gnu-imap4d\[[0-9]+\]: Incoming connection opened
    111. 

  111. gnu-imap4d\[[0-9]+\]: connect from [\.0-9]+
    112. 

  112. gnu-imap4d\[[0-9]+\]: User '[[:alnum:]]+' logged in
    113. 

  113. gnu-imap4d\[[0-9]+\]: Session timed out for user: [[:alnum:]]+
    114. 

  114. gnu-imap4d\[[0-9]+\]: got signal Alarm clock
    115. 

  115. ### ignore.d.server/misc
    116. 

  116. # Figure out if these belong to dhcp or dhcp3-common (or dhclient?)
    117. 

  117. dhcpd.*: Reclaiming( REQUESTed) abandoned IP address [\.0-9]+
    118. 

  118. dhcpd.*: already acking lease
    119. 

  119. dhcpd.*: send_packet: Connection refused
    120. 

  120. dhcpd.*: fallback_discard: Connection refused
    121. 

  121. # These show up when isdnutils is installed, but isn't strictly related to those packages
    122. 

  122. kernel: isdn_net: call from [,0-9]+ -> [0-9]+
    123. 

  123. kernel: isdn_net: Service-Indicator not [0-9], ignored
    124. 

  124. # This one shows up with firewalls blocking SMB ports non-silently
    125. 

  125. kernel: Packet log: input DENY eth[0-9]+ PROTO=17 .*:(137|138) .*:(137|138) L=[0-9]+ S=0x00 I=[0-9]+ F=0x0000 T=[0-9]+ \(#[0-9]+\)
    126. 

  126. ### ignore.d.server/murasaki
    127. 

  127. murasaki\.usb\[[0-9]+\]: found depended module="[[:alnum:]]+"
    128. 

  128. murasaki\.(usb|net)\[[0-9]+\]: try expanding "\[net\]"
    129. 

  129. murasaki\.(usb|net)\[[0-9]+\]: dependent\(net\) is found
    130. 

  130. murasaki\.(usb|net)\[[0-9]+\]: net device is (added|removed|(un)?register(e)?d)
    131. 

  131. murasaki\.(usb|net)\[[0-9]+\]: Execuing "net" "(stop|start)"
    132. 

  132. murasaki\.(usb|net)\[[0-9]+\]: execute if(up|down) (eth|(i)?ppp|irda)[0-9]
    133. 

  133. murasaki\.usb\[[0-9]+\]: (MATCH\(audio\) -> match_flags:[[:alnum:]]+ )?vendor:[[:alnum:]]+ product:[[:alnum:]]+ Dclass:[[:alnum:]]+ Dsubclass:[[:alnum:]]+ Dprotocol:[[:alnum:]]+ Iclass:[[:alnum:]]+ Isubclass:[[:alnum:]]+ Iprotocol:[[:alnum:]]+
    134. 

  134. ### ignore.d.server/netatalk.changes
    135. 

  135. afpd\[[0-9]+\]: CNID DB initialized using Sleepycat Software: Berkeley DB
    136. 

  136. afpd\[[0-9]+\]: removed [^[:space:]]+/net[\.0-9]+node[0-9]+
    137. 

  137. afpd\[[0-9]\]: ((dhx|cleartext|randnum/rand2num) )?login: [[:alnum:]]+
    138. 

  138. afpd\[[0-9]\]: (server_child\[[0-9]+\] [0-9]+ )?(done|exited 1)
    139. 

  139. afpd\[[0-9]\]: ASIP session:[0-9]+\([0-9]+\) from [\.:0-9]+\([0-9]+\)
    140. 

  140. afpd\[[0-9]\]: Connection terminated
    141. 

  141. afpd\[[0-9]\]: [\.[:alnum:]]+ read, [\.[:alnum:]]+ written
    142. 

  142. afpd\[[0-9]\]: [^[:space:]]+: Broken pipe
    143. 

  143. afpd\[[0-9]\]: [^[:space:]]+: Connection reset by peer
    144. 

  144. afpd\[[0-9]\]: [^[:space:]]+: Connection timed out
    145. 

  145. afpd\[[0-9]\]: [^[:space:]]+: No route to host
    146. 

  146. afpd\[[0-9]\]: [^[:space:]]+: No such file or directory
    147. 

  147. afpd\[[0-9]\]: [^[:space:]]+: Permission denied
    148. 

  148. afpd\[[0-9]\]: [^[:space:]]+: child timed out
    149. 

  149. afpd\[[0-9]\]: afp_openfork: ad_open: File Exists
    150. 

  150. afpd\[[0-9]\]: asp_alrm: [0-9]+ timed out
    151. 

  151. afpd\[[0-9]\]: login [[:alnum:]]+ \(uid [0-9]+, gid [0-9]+\)
    152. 

  152. afpd\[[0-9]\]: login noauth
    153. 

  153. afpd\[[0-9]\]: logout [[:alnum:]]+
    154. 

  154. afpd\[[0-9]\]: registering [[:alnum:]]+ \(uid [0-9]+\) on [\.0-9]+ as /.+/net[\.0-9]+node[0-9]+
    155. 

  155. afpd\[[0-9]\]: session from [\.:0-9]+ on [\.:0-9]+
    156. 

  156. afpd\[[0-9]\]: uams_dhx_pam.c :PAM: PAM (Auth OK!|Success -- Success)
    157. 

  157. afpd\[[0-9]\]: using codepage directory: /etc/netatalk/nls/maccode\.[\.[:alnum:]-]+
    158. 

  158. atalkd\[[0-9]+\]: [^[:space:]]+: zip gnireply from [\.0-9]+ \([^[:space:]]+\)
    159. 

  159. atalkd\[[0-9]+\]: [^[:space:]]+: zip ignoring gnireply
    160. 

  160. atalkd\[[0-9]\]: [^[:space:]]+: Network is unreachable
    161. 

  161. atalkd\[[0-9]\]: zip gnireply from [\.0-9]+ \([^[:space:]]+\)
    162. 

  162. atalkd\[[0-9]\]: zip ignoring gnireply
    163. 

  163. papd\[[0-9]\]: child [0-9]+ done
    164. 

  164. papd\[[0-9]\]: child [0-9]+ for "[^[:space:]]+" from [\.0-9]+
    165. 

  165. ### ignore.d.server/netsaint
    166. 

  166. netsaint: SERVICE (ALERT|NOTIFICATION|FLAPPING ALERT): .*
    167. 

  167. netsaint: Auto-save of retention data completed successfully\.
    168. 

  168. netsaint: HOST ALERT:.*;DOWN;SOFT;.*;CRITICAL - Plugin timed out after 10 seconds
    169. 

  169. netsaint: HOST ALERT:*;UP;SOFT;.*;PING OK - Packet loss = 0%, RTA =.*ms
    170. 

  170. netsaint: SERVICE ALERT:.*;HTTP;CRITICAL;HARD;.*;Connection refused or timed out
    171. 

  171. ### ignore.d.server/non-debian
    172. 

  172. # These entries are for syslogd open for remote hosts
    173. 

  173. # (and advertised through DHCP)
    174. 

  174. #
    175. 

  175. # HP printers
    176. 

  176. printer: peripheral low-power state
    177. 

  177. printer: paper out
    178. 

  178. printer: error cleared
    179. 

  179. printer: powered up
    180. 

  180. printer: ready to print
    181. 

  181. ### ignore.d.server/ntp-simple.changes
    182. 

  182. ntpd\[[0-9]+\]: kern_enable is 1
    183. 

  183. ntpd\[[0-9]+\]: precision = [0-9]+ usec
    184. 

  184. ntpd\[[0-9]+\]: signal_no_reset: signal 13 had flags [0-9]+
    185. 

  185. ntpd\[[0-9]+\]: using kernel phase-lock loop [0-9]+
    186. 

  186. ### ignore.d.server/pop-before-smtp
    187. 

  187. pop-before-smtp\[[0-9]+\]: (opening|closing) relay for [\.0-9]+( --- not in mynetworks)?
    188. 

  188. ### ignore.d.server/postfix
    189. 

  189. postfix/[[:alnum:]]+\[[0-9]+\]: table has changed -- exiting
    190. 

  190. postfix/cleanup\[[0-9]+\]: warning: premature end-of-input from cleanup socket while reading input attribute name
    191. 

  191. postfix/local\[[0-9]+\]: warning: unable to create lock file /var/mail/[[:alnum:]]+\.lock: Permission denied
    192. 

  192. postfix/master\[[0-9]+\]: reload configuration
    193. 

  193. postfix/postfix-script: refreshing the Postfix mail system
    194. 

  194. postfix/qmgr\[[0-9]+\]: [A-Z0-9]+: skipped, still being delivered
    195. 

  195. postfix/smtp\[[0-9]+\]: [A-Z0-9]+: enabling PIX <CRLF>\.<CRLF> workaround for [\.[:alnum:]-]+\[[\.0-9]+\]
    196. 

  196. postfix/smtp\[[0-9]+\]: [^[:space:]]+ status=deferred \(connect to [^[:space:]]+: (Connection refused|server refused mail service)\)
    197. 

  197. postfix/smtp\[[0-9]+\]: connect to [^[:space:]]+: (Connection (refused|reset by peer|timed out)|read timeout|server (refused mail service|dropped connection)|No route to host) \(port 25\)
    198. 

  198. postfix/smtp\[[0-9]+\]: warning: bad size limit "truncates" in EHLO reply from [^[:space:]]+
    199. 

  199. postfix/smtp\[[0-9]+\]: warning: host [\.[:alnum:]-]+\[[\.0-9]+\] (greeted me|replied to HELO/EHLO) with my own hostname [\.[:alnum:]-]+
    200. 

  200. postfix/smtp\[[0-9]+\]: warning: mailer loop: best MX host for [^[:space:]]+ is local
    201. 

  201. postfix/smtp\[[0-9]+\]: warning: no MX host for [\.[:alnum:]-]+ has a valid A record
    202. 

  202. postfix/smtp\[[0-9]+\]: warning: numeric domain name in resource data of MX record for [^[:space:]]+: [\.0-9]+
    203. 

  203. postfix/smtpd\[[0-9]+\]: (lost connection|timeout) after [^ ]+ from [\.[:alnum:]-]+\[[\.0-9]+\]
    204. 

  204. postfix/smtpd\[[0-9]+\]: warning: [^[:space:]]+ sent (message header|mail content) instead of SMTP command:
    205. 

  205. postfix/smtpd\[[0-9]+\]: warning: [^[:space:]]+: address not listed for hostname [^[:space:]]+
    206. 

  206. postfix/smtpd\[[0-9]+\]: warning: [^[:space:]]+: hostname [\.[:alnum:]-]+ verification failed: Host (name has no address|not found)
    207. 

  207. ### ignore.d.server/postgresql
    208. 

  208. postgres\[[0-9]+\]: \[[0-9-]+\] \^ICPU .* sec elapsed .* sec\.
    209. 

  209. postgres\[[0-9]+\]: \[[0-9-]+\] \^ITotal CPU .* sec elapsed .* sec\.
    210. 

  210. ### ignore.d.server/ppp
    211. 

  211. chat\[[0-9]+\]: abort on \(.*\)
    212. 

  212. chat\[[0-9]+\]: expect \(.*\)
    213. 

  213. chat\[[0-9]+\]: send \(AT.*\^M\)
    214. 

  214. chat\[[0-9]+\]:  -- got it
    215. 

  215. chat\[[0-9]+\]: AT.*\^M\^M
    216. 

  216. chat\[[0-9]+\]: \^M
    217. 

  217. chat\[[0-9]+\]: CONNECT
    218. 

  218. chat\[[0-9]+\]: OK
    219. 

  219. chat\[[0-9]+\]: send \(\\d\)
    220. 

  220. ### ignore.d.server/proftpd
    221. 

  221. proftpd\[[0-9]+\]: [^[:space:]]+ \([^[:space:]]+\[[\.0-9]+\]\) - FTP session opened\.
    222. 

  222. proftpd\[[0-9]+\]: [^[:space:]]+ \([^[:space:]]+\[[\.0-9]+\]\) - FTP login timed out, disconnected\.
    223. 

  223. proftpd\[[0-9]+\]: [^[:space:]]+ \([^[:space:]]+\[[\.0-9]+\]\) - USER (anonymous|ftp)(@[\.[:alnum:]]+)? \(Login failed\): Can't find user\.
    224. 

  224. proftpd\[[0-9]+\]: [^[:space:]]+ \([^[:space:]]+\[[\.0-9]+\]\) - USER (anonymous|ftp)(@[\.[:alnum:]]+)?: no such user found from .*\[[\.0-9]+\] to [\.0-9]+
    225. 

  225. proftpd\[[0-9]+\]: [^[:space:]]+ \([^[:space:]]+\[[\.0-9]+\]\) - no such user '(anonymous|ftp)(@[\.[:alnum:]]+)?'
    226. 

  226. proftpd\[[0-9]+\]: connect from [\.0-9]+
    227. 

  227. proftpd\[[0-9]+\]: No certificate files found!
    228. 

  228. proftpd\[[0-9]+\]: [^[:space:]]+ ([^[:space:]]+\[[\.0-9]\]) - Refused PORT.* (address mismatch)\.
    229. 

  229. ### ignore.d.server/samba
    230. 

  230. smbd\[[0-9]+\]:   read(_socket)?_data: (read|recv) failure for 4\. Error = (No route to host|Connection reset by peer)
    231. 

  231. smbd\[[0-9]+\]: \[[/0-9]+ [:0-9]+, [0-9]+\] lib/util_sock.c:read(_socket)?_data\([0-9]+\)
    232. 

  232. ### ignore.d.server/spamassassin
    233. 

  233. spamd\[[0-9]+\]: Creating default_prefs
    234. 

  234. spamd\[[0-9]+\]: connection from .* at port
    235. 

  235. spamd\[[0-9]+\]: clean message for
    236. 

  236. spamd\[[0-9]+\]: identified spam for
    237. 

  237. spamd\[[0-9]+\]: skipped large message in
    238. 

  238. ### ignore.d.server/squid
    239. 

  239. squid\[[0-9]+\]:   Finished.  Wrote [0-9]+ entries\.
    240. 

  240. squid\[[0-9]+\]:   Took [\.0-9]+ seconds \(.* entries/sec\)\.
    241. 

  241. squid\[[0-9]+\]: (access|store)LogRotate: Rotating(\.)?
    242. 

  242. squid\[[0-9]+\]: logfileRotate: /var/log/squid/(access|store).log
    243. 

  243. squid\[[0-9]+\]: (Closing Pinger socket|Pinger socket opened) on FD [0-9]+
    244. 

  244. squid\[[0-9]+\]: NETDB state saved;
    245. 

  245. squid\[[0-9]+\]: storeDirWriteCleanLogs: Starting\.\.\.
    246. 

  246. squid\[[0-9]+\]: helperOpenServers: Starting [0-9]+ '.*' processes
    247. 

  247. ### ignore.d.server/ssh
    248. 

  248. sshd\[[0-9]+\]: syslogin_perform_logout: logout\(\) returned an error
    249. 

  249. sshd\[[0-9]+\]: Could not reverse map address .*\.
    250. 

  250. sshd\[[0-9]+\]: Connection closed by .*
    251. 

  251. sshd\[[0-9]+\]: Did not receive ident(ification)? string from [\.0-9]+
    252. 

  252. sshd\[[0-9]+\]: scanned from [\.0-9]+ with SSH-1\.0-SSH_Version_Mapper\.  Don't panic\.
    253. 

  253. sshd\[[0-9]+\]: Disconnecting: Your ssh version is too old and is no longer supported\.  Please install a newer version\.
    254. 

  254. sshd\[[0-9]+\]: Accepted (keyboard-interactive|publickey) for [[:alnum:]]+ from [\.0-9]+ port [0-9]+ ssh2
    255. 

  255. sshd\[[0-9]+\]: warning: /etc/hosts.deny, line 15: can't verify hostname: gethostbyname(.*) failed
    256. 

  256. sshd\[[0-9]+\]: refused connect from .*
    257. 

  257. sshd\[[0-9]+\]: Received disconnect from [\.0-9]+: 11: Disconnect requested by Windows SSH Client.
    258. 

  258. sshd\[[0-9]+\]: subsystem request for sftp
    259. 

  259. ### ignore.d.server/ssmtp
    260. 

  260. sSMTP mail\[[0-9]+\]: .* sent mail for root
    261. 

  261. ### ignore.d.server/tftpd
    262. 

  262. in.tftpd\[[0-9]+\]: RRQ from.*filename.*
    263. 

  263. in.tftpd\[[0-9]+\]: tftp: client does not accept options 
    264. 

  264. ### ignore.d.server/tmp
    265. 

  265. ## imp
    266. 

  266. IMP\[[0-9]+\]: FAILED .* to .*:143 as .*
    267. 

  267. ## libpam-modules
    268. 

  268. PAM_unix\[[0-9]+\]: authentication failure; \(uid=0\) -> .* for (imap|netatalk|pop|samba|ssh) service
    269. 

  269. # old-style pam entries (no longer provided by logcheck but needed on woody
    270. 

  270. PAM_.*: .* session (opened|closed) for user .*
    271. 

  271. ## netatalk
    272. 

  272. afpd\[[0-9]+\]: uams_dhx_pam\.c :PAM: PAM (Auth OK!|Success -- .*|User entered a null value -- .*)
    273. 

  273. afpd\[[0-9]+\]: uams_dhx_pam\.c :PAM: PAM_Error: Authentication failure -- (Bad file descriptor|Invalid argument)
    274. 

  274. afpd\[[0-9]+\]: uams_dhx_pam\.c :PAM: PAM: User entered a null value -- No such file or directory
    275. 

  275. afpd\[[0-9]+\]: afp_getsrvrparms: stat /volumes/(km/kmstab/kmstab|kp/kp/kp(/kp|/kpstab|stab/kpstab)|misc/flstab/flstab): Permission denied
    276. 

  276. afpd\[[0-9]+\]: bad function 7A
    277. 

  277. atalkd\[[0-9]+\]: as_timer sendto: Netvaerket er ikke tilgaengeligt
    278. 

  278. ## hylafax-server
    279. 

  279. FaxGetty\[[0-9]+\]: ANSWER: Can not lock modem device
    280. 

  280. gnome-name-server\[[0-9]+\]: server_is_alive: .*
    281. 

  281. ## uw-imap
    282. 

  282. i(map|pop3)d\[[0-9]+\]: (AUTHENTICATE (LOGIN|PLAIN) failure|Login failed)( user=.*)? host=(.* )?\[.*\]
    283. 

  283. ## ppp
    284. 

  284. ipppd\[[0-9]+\]: Connect\[0\]: /dev/ippp[0-9], fd: 12
    285. 

  285. ## misc
    286. 

  286. kernel: Disorder[0-9] [0-9] [0-9] f[0-9] s[0-9] rr[0-9]
    287. 

  287. kernel: IP_MASQ:reverse ICMP: failed checksum from .*!
    288. 

  288. kernel: OPEN: [\.0-9]* -> [\.0-9]* UDP, port: [0-9]* -> [0-9]*
    289. 

  289. kernel: Packet log: input DENY eth1 PROTO=1 0.0.0.0:5 10.0.0.40:1 L=427 S=0xD0 I=0 F=0x4000 T=255 \(#22\)
    290. 

  290. kernel: lp[0-9]: compatibility mode
    291. 

  291. kernel: Undo( partial)? (Hoe|loss|retrans)
    292. 

  292. printer: offline or intervention needed
    293. 

  293. ## ntp-simple
    294. 

  294. ntpd\[[0-9]+\]: synchronisation lost
    295. 

  295. ntpd\[[0-9]+\]: synchronisation lost
    296. 

  296. ntpd\[[0-9]+\]: time reset [\.0-9-]* .
    297. 

  297. ntpd\[[0-9]+\]: time reset [\.0-9-]+ s
    298. 

  298. ## portsentry
    299. 

  299. portsentry\[[0-9]+\]: attackalert: .*
    300. 

  300. ## pump
    301. 

  301. pumpd\[[0-9]+\]: SO_BINDTODEVICE eth0 \(4\) failed: Invalid argument
    302. 

  302. ## samba
    303. 

  303. smbd\[[0-9]+\]:   read_socket_data: recv failure for 4. Error = No route to host
    304. 

  304. smbd\[[0-9]+\]:   smb_pam_passcheck: PAM: smb_pam_auth failed - Rejecting User [[:alnum:]]+ !
    305. 

  305. smbd\[[0-9]+\]: \[[/[0-9]]+ [:[0-9]]+, 0\] smbd/service.c:find_service\([0-9]+\)
    306. 

  306. smbd\[[0-9]+\]:   yield_connection: tdb_delete for name  failed with error Record does not exist\.
    307. 

  307. smbd\[[0-9]+\]: \[.*\] smbd/connection.c:yield_connection\([0-9]+\)
    308. 

  308. smbd\[[0-9]+\]: \[.*\] passdb/pampass.c:smb_pam_passcheck\([0-9]+\)
    309. 

  309. sshd\[[0-9]+\]: Failed password for .*
    310. 

  310. sshd\[[0-9]+\]: packet_set_maxsize: setting to 4096
    311. 

  311. ## postfix
    312. 

  312. postfix.*\[[0-9]+\]: .* from=<groove@mailomat.grooveattack.com>
    313. 

  313. postfix/smtpd\[[0-9]+\]: warning: Illegal address syntax from [\.[:alnum:]-]+\[[\.0-9]+\] in MAIL command: <C:\\Email\\Headers\\fresh froms 5-1\.txt>
    314. 

  314. 

  315. rpc.mountd: authenticated mount request from .* for .*
    316. 

  316. ## snort
    317. 

  317. snort: .*FrontPage
    318. 

  318. snort: IDS015 - RPC - portmap-request-status:
    319. 

  319. snort: IDS029 - SCAN-Possible Queso Fingerprint attempt:
    320. 

  320. snort: IDS115 - MISC-Traceroute-UDP:
    321. 

  321. snort: IDS212 - MISC - DNS Zone Transfer:
    322. 

  322. snort: IDS226 - CVE-1999-0172 - CGI-formmail:
    323. 

  323. snort: IDS246 - MISC - Large ICMP Packet:
    324. 

  324. snort: IIS-
    325. 

  325. snort: MISC-Attempted Sun RPC high port access:
    326. 

  326. snort: NETBIOS-SMB-C:
    327. 

  327. snort: NETBIOS-SMB-CD...:
    328. 

  328. snort: NMAP TCP ping!:
    329. 

  329. snort: RPC Info Query:
    330. 

  330. snort: SCAN-SYN FIN:
    331. 

  331. snort: spp_http_decode: IIS Unicode attack detected:
    332. 

  332. snort: spp_portscan: End of portscan
    333. 

  333. snort: spp_portscan: PORTSCAN DETECTED
    334. 

  334. snort: spp_portscan: portscan status from
    335. 

  335. snort: WEB-../..:
    336. 

  336. snort: WEB-CGI-upload.pl:
    337. 

  337. ## postgres
    338. 

  338. postgres\[[0-9]+\]: \[.*\] DEBUG:
    339. 

  339. postgres\[[0-9]+\]: \[[0-9-]*\]  Re-using: Free/Avail. Space .* EndEmpty/Avail\. Pages .* CPU .* sec\.
    340. 

  340. postgres\[[0-9]+\]: \[[0-9-]*\] [0-9]*; Re-using: Free/Avail. Space .* EndEmpty/Avail\. Pages .* CPU .* sec\.
    341. 

  341. ### ignore.d.server/ucd-snmp
    342. 

  342. ucd-snmp\[[0-9]+\]: Connection from .*
    343. 

  343. ### ignore.d.server/uw-imap.changes
    344. 

  344. imapd\[[0-9]+\]: (port 143|imap|imaps SSL) service init from
    345. 

  345. imapd\[[0-9]+\]: No route to host, while reading line user=.* host=(([^[:space:]]+ )?\[[\.0-9]+\]|UNKNOWN)
    346. 

  346. i(map|pop3)d\[[0-9]+\]: Killed \(lost mailbox lock\) user=.* host=(([^[:space:]]+ )?\[[\.0-9]+\]|UNKNOWN)
    347. 

  347. i(map|pop3)d\[[0-9]+\]: (Login|Auth|Authenticated|Logout|Autologout) user=.* host=(([^[:space:]]+ )?\[[\.0-9]+\]|UNKNOWN)
    348. 

  348. i(map|pop3)d\[[0-9]+\]: Moved [0-9]+ bytes of new mail to .* from .* host=(([^[:space:]]+ )?\[[\.0-9]+\]|UNKNOWN)
    349. 

  349. i(map|pop(2|3))d\[[0-9]+\]: (Broken pipe|Command stream end of file|Connection (reset by peer|timed out))(,)? while (reading (authentication|line|literal|char)|writing text) (user=.* )?host=(([^[:space:]]+ )?\[[\.0-9]+\]|UNKNOWN)
    350. 

  350. ipop[2|3]d\[[0-9]+\]: (connect|pop3(s SSL)? service init) from [\.0-9]+
    351. 

  351. ipop3d\[[0-9]+\]: Trying to get mailbox lock from process [0-9]+
    352. 

  352. ipop3d\[[0-9]+\]: Error opening or locking INBOX user=.* host=(([^[:space:]]+ )?\[[\.0-9]+\]|UNKNOWN)
    353. 

  353. ipop3d\[[0-9]+\]: Expunge ignored on readonly mailbox
    354. 

  354. ipop3d\[[0-9]+\]: Mailbox is open by another process, access is readonly
    355. 

  355. ipop3d\[[0-9]+\]: Moved [0-9]+ bytes of new mail to [^[:space:]]+ from [^[:space:]]+ host= (([^[:space:]]+ )?\[[\.0-9]+\]|UNKNOWN)
    356.
generated by cgit v1.2.3 (git 2.46.0) at 2025-01-13 14:38:17 +0000