#686144 logcheck: ignore.d.server/imapproxy regex for LOGIN and LOGOUT lines from syslog wrong

Package:
logcheck
Source:
logcheck
Submitter:
Sven Fischer
Date:
2024-06-01 11:51:03 UTC
Severity:
normal
Tags:
#686144#5
Date:
2012-08-29 05:03:36 UTC
From:
To:
In ignore.d.server/imapproxy the first two lines (LOGIN and LOGOUT) for the regex contain double quotes. These are too much, hence the regex does not work when used with syslog.
Leaving them out, solves the problem.

example syslog entries for imapproxyd, which should match with the logcheck rules for imapproxy:
Aug 29 00:10:23 vserver1901 in.imapproxyd[22478]: LOGIN: 'info@linux44tw.de' (127.0.0.1:41773) on existing sd [10]
Aug 29 00:10:24 vserver1901 in.imapproxyd[22478]: LOGOUT: 'info@linux44tw.de' from server sd [10]

Original lines:
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ in.imapproxyd\[[0-9]+\]: LOGOUT: '"[_[:alnum:]-]+(@[-_.[:alnum:]]+)?"' from server sd \[[0-9]+\]$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ in.imapproxyd\[[0-9]+\]: LOGIN: '"[_[:alnum:]-]+(@[-_.[:alnum:]]+)?"' \([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}:[0-9]+\) on (existing|new) sd \[[0-9]+\]$

lines adjusted to work with the syslog entries from imapproxy:
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ in.imapproxyd\[[0-9]+\]: LOGOUT: '[_[:alnum:]-]+(@[-_.[:alnum:]]+)?' from server sd \[[0-9]+\]$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ in.imapproxyd\[[0-9]+\]: LOGIN: '[_[:alnum:]-]+(@[-_.[:alnum:]]+)?' \([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}:[0-9]+\) on (existing|new) sd \[[0-9]+\]$

Two quotation marks too much in each line. That's it.

#686144#14
Date:
2024-06-01 11:46:10 UTC
From:
To:
control: tags -1 + moreinfo

It's a shame no-one replied to this bug report from 2012 - i wonder if
it is still valid?