On Wed, 14 Nov 2012 03:50:07 +0100 Carlos Alberto Lopez Perez
<clo...@igalia.com> wrote:
> Package: logcheck-database
> Hello,
>
> After deploying DMA, I found that logcheck is not filtering the typical
> notification messages of mail delivery that any mailer daemon generates.
>
> I successfully filtered all this notification messages with the following
> rules
>
> # cat /etc/logcheck/ignore.d.server/dma
> ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dma\[[0-f.]+\]: new mail from
> user=[[:alpha:]]+ uid=[0-9]+ envelope_from=<[@._[:alnum:]-]+>$
> ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dma\[[0-f.]+\]: mail
> to=<[@._[:alnum:]-]+> queued as [0-f.]+$
> ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dma\[[0-f.]+\]: trying delivery$
> ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dma\[[0-f.]+\]: using smarthost
> \([._[:alnum:]-]+:[0-9]+\)
> ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dma\[[0-f.]+\]: trying remote
> delivery to [._[:alnum:]-]+ \[[0-9.:]+\] pref [0-9]+$
> ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dma\[[0-f.]+\]: delivery successful$
> Please, consider adding such rules to logcheck-database
Hi, it's a shame no-one replied since this bug was reported in 2012.
Is there still interest in adding these to logcheck?
It seems good in principal, but im unsure about some of the above:
* eg dma\[[0-f.]+\] -- normally the bit in [...] would be the pid, so
only 0-9 would be needed?
* user=[[:alpha:]]+ looks more restrictive than most usernames
* if this is email-related i was expecting more "@"s!
* most programs have a "." at the end of messages --- fine if dma does
not of course
(we should check against the code https://salsa.debian.org/debian/dma
if possible, but a reply confirming onoing interest would be great)
