When using with syslog-ng configured to also log the source of the log
entry log lines look like:

| Apr 24 06:47:01 s_local@nikki CRON[13878]: (pam_unix) session opened for user root by (uid=0)

Now logcheck doesn't usually allo for the @ in logs which results in
bascially no ignore line matching.  Please add @ to the regexes, thanks.

| System Events
| =-=-=-=-=-=-=
| Apr 24 06:47:01 s_local@nikki CRON[13878]: (pam_unix) session opened for user root by (uid=0)
| Apr 24 06:47:01 s_local@nikki su[13895]: + ??? root:nobody
| Apr 24 06:47:01 s_local@nikki su[13895]: (pam_unix) session opened for user nobody by (uid=0)
| Apr 24 06:47:06 s_local@nikki CRON[13878]: (pam_unix) session closed for user root
[..]


Peter

~/src/logcheck/rulefiles/linux$ egrep '\[._\[:alnum:\]-\]'  -r . | wc -l
896

that's not fun. while changing all those we'd better switch to the use of
macros. very inclined to merge that with those open bugs.
regards
--
maks

<snip log snippets>

Speaking of sed magic..

for i in *; do cat $i | sed -e "s/\[\._\[:alnum:\]-\]+/\[\._@\[:alnum:
\]-\]\+/" >> $i.new; done

..appears to work here..

yes i know, could have done something similar with perl,
but we just want to change all hostname and who says they
are exactly formated like aboves and really hostnames you
change. needs human edit and than it's better to do it
right, no?

regards

That only matches the first occurrence of [._[:alnum:]-]+ and since
every rule starts with "^\w{3} [ :0-9]{11} [._[:alnum:]-]+" it'll only
change the regexp we use for the hostname.

It's better than manually going through and changing every occurrence
800+ times. I've tested it here:

$ for i in *; do cat $i | sed -e "s/\[\._\[:alnum:\]-\]+/\[\._@\[:alnum:
\]-\]\+/" >> $i.new; done

$ egrep -vf ../logcheck/rulefiles/linux/TEST_ignore.d.server/postfix.new
postfix.log | egrep
-vf ../logcheck/rulefiles/linux/violations.ignore.d/logcheck-postfix
$

They work just as well as the old rules, they just match the additional
'@'..

However, if you'd rather wait for macro support, that's fine.

http://wiki.logcheck.org/index.cgi/LogcheckTemplateSystem
:)