Dear Maintainer,

The winbind rules shipped with logcheck-database do not properly match
the log entries generated by pam_winbind.  An example of the pam_winbind
log entries is as follows:

Dec  5 21:50:54 servername sshd[16250]: pam_winbind(sshd:auth): getting password (0x00000000)
Dec  5 21:50:55 servername sshd[16250]: pam_winbind(sshd:auth): user 'username' granted access

However, the winbind rules do not account for the daemon name in the log
messages and thus fail to match.  I am unsure if the PAM log format
has changed, or if there might be cases where messages lacking the
daemon name are produced.

I have attached a patch which updates the winbind rules to match log
messages in the above format (using libpam-krb as a guide - which only
supports messages in this format).  Additionally, I have attached a
second patch which ignores the "getting password" messages, as I can not
think of a likely scenario where they would be of interest to an
administrator.

Thanks,
Kevin