I have a couple of home-made logcheck ignore files, and happened to
have one unescaped (and unmatched) `(' in one of the filter
lines. Because of this, cron sent a mail with the body "grep: Invalid
regular expression" - the subject is the command in the "2 * * * *"
line in /etc/cron.d/logcheck, of course.

It would be nice if logcheck would tell me in which file the error
was. This should be easy, since egrep returns 1 if it finds no match
and 2 with an invalid regular expression.

Regards, Frank

If you run logcheck in debug mode you'll be able to find out which file
the error is in.

For example, I added this to ignore.d.server/logcheck:

^\w{3} [ :0-9]{11} [._[:alnum:]-]+ foobar\[[0-9]+\]: test (foo test$

Running logcheck -otd gives:

[...]
D: [1108580515] cleanchecked - dir
- /tmp/logcheck.pFqP43/ignore/logcheck
grep: Invalid regular expression
[...]

I think this is what you're looking for?

"Jamie L. Penman-Smithson" <jamie@silverdream.org> wrote:

No, not really. I know I can find the problematic file this way. But I
would prefer to get an indication about this in the mail that cron
sends. If an inexperienced user gets a mail with a subject from some
crontab file and a body that only says "grep: invalid regular
expression", he will problably not know at once what this means (and I
must say that I was not sure that it was an error in one of my logcheck
filter files until I saw the debug output).

What I suggest is that for each egrep over the filter files, you check
whether the return value is 2, and if yes send a message to stderr:

"logcheck found an invalid regular expression in file $file"

(ideally with the temporary directory mapped back to the original
location).

Regards, Frank

Cool. I like this idea.  Expect to see it soon.

We believe that the bug you reported is fixed in the latest version of
logcheck, which is due to be installed in the Debian FTP archive:

logcheck-database_1.2.36_all.deb
  to pool/main/l/logcheck/logcheck-database_1.2.36_all.deb
logcheck_1.2.36.dsc
  to pool/main/l/logcheck/logcheck_1.2.36.dsc
logcheck_1.2.36.tar.gz
  to pool/main/l/logcheck/logcheck_1.2.36.tar.gz
logcheck_1.2.36_all.deb
  to pool/main/l/logcheck/logcheck_1.2.36_all.deb
logtail_1.2.36_all.deb
  to pool/main/l/logcheck/logtail_1.2.36_all.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 295560@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Todd Troxell <ttroxell@debian.org> (supplier of updated logcheck package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)
Format: 1.7
Date: Wednesday, 30 Mar 2005 20:04:00 -0600
Source: logcheck
Binary: logcheck logtail logcheck-database
Architecture: source all
Version: 1.2.36
Distribution: unstable
Urgency: low
Maintainer: Debian logcheck Team <logcheck-devel@lists.alioth.debian.org>
Changed-By: Todd Troxell <ttroxell@debian.org>
Description:
 logcheck   - Mails anomalies in the system logfiles to the administrator
 logcheck-database - A database of system log rules for the use of log checkers
 logtail    - Print log file lines that have not been read
Closes: 295560 296096 298291 301415
Changes:
 logcheck (1.2.36) unstable; urgency=low
 .
   jamie:
   * Update rules for gps 1.0>.
   * Add/update rules for innd.
   maks:
   * Add harmless pdns rule at server level.
   * Add rules for cups-lpd at level server.
   * Add violations.ignore.d/logcheck-dcc for the nightly dccifd reporting.
   * Add rule ignore.d.server/kernel for printer out of paper.
     (Closes: #298291)
   * Add one more apm rule for useless gdm logout message.
   * Add rules for 2 harmless dhcpd and dhclient messages.
   * Add cvsd, pam rules from Peter Palfrader <weasel@debian.org>.
   * Add ssh rule for timeout before authentication.
   * Check time of rotated logfile against already gzipped logfile.
     syslog-ng leaves old syslog.0 logfile in /var/log. (Closes: #296096)
   todd:
   * Add support for warnings in report
   * Update copyright dates
   * Warn on invalid regex (Closes: #295560)
   * Update udev for directories (Matt Brubeck) (Closes: #301415)
Files:
 413fc7df7619779bf5be7169dd3f16a0 703 admin optional logcheck_1.2.36.dsc
 7d0502bd49d96f15c75350b400d31d47 92454 admin optional logcheck_1.2.36.tar.gz
 1ffd732d134b16d85dac2098dbdb1057 43720 admin optional logcheck_1.2.36_all.deb
 27c54567364a981400d2c6fed97e4473 60124 admin optional logcheck-database_1.2.36_all.deb
 424e9b589413f54e8f978ceac3289289 26646 admin optional logtail_1.2.36_all.deb
iD8DBQFCS1va4u3oQ3FHP2YRAkZ1AKCwzmDPnTpaCMUDtXvwWMfYfY7PGQCePwly
+/QqD7WsxiPC6EzHE9ZIvvs=
=1//C
-----END PGP SIGNATURE-----

There was a failed attempt at this:

The reversion is here
http://cvs.alioth.debian.org/cgi-bin/cvsweb.cgi/logcheck/src/logcheck.diff?r1=1.109&r2=1.110&cvsroot=logcheck

This patch does not work for me in 1.2.47.

Here's a (quick and dirty) way to determine the line number of a broken
regular expression in a logcheck rule file. It doesn't solve the problem
of not so useful output on cron jobs, though.

#!/bin/bash
#
# Quick and dirty script to determine the line number of a broken
# regular expression in a logcheck ignore rule file.
#
#FILETOEXAMINE=/etc/logcheck/ignore.d.server/kernel
FILETOEXAMINE=$1
ALLLINES=`grep -c '^' $FILETOEXAMINE`

for ((LINENUMBER=1; LINENUMBER<=ALLLINES; LINENUMBER++))
do
  GREPRESULT=`head -n $LINENUMBER $FILETOEXAMINE | tail -n 1 | egrep -f
- 2>&1`
  if [ "x$GREPRESULT" != "x" ]; then
    echo "$LINENUMBER:  $GREPRESULT"
  fi
done