- Package:
- logcheck-database
- Source:
- logcheck
- Submitter:
- Simon Waters
- Date:
- 2014-10-20 19:09:04 UTC
- Severity:
- normal
Wheezy box with hostname validation checks and verify cache
I needed three rule changes to silence normal reports from postfix on Wheezy.
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ postfix/smtpd\[[[:digit:]]+\]: warning: hostname [. _[:alnum:]-]+ does not resolve to address [[:digit:]\.]+(: Temporary failure in name resolution|: Name or service not known|: No address associated with hostname|)$
This rule includes text from existing rules, so perhaps those rules can be retired? The repetition of ": " in the text is unwieldy.
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ postfix/verify\[[[:digit:]]+\]: close database /var/lib/postfix/verify_cache.db: No such file or directory \(possible Berkeley DB bug\)$
This rule addresses known spurious Berkeley DB warning.
http://tech.groups.yahoo.com/group/postfix-users/message/261323
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ postfix/verify\[[[:digit:]]+\]: cache [-._:[:alnum:]/]+ full cleanup: retained=[[:digit:]]+ dropped=[[:digit:]]+ entries$
The cache name will by default begin "btree:/var/..." so I've added a ":" to existing rule after the word cache.
Sure maintaining these lists is a thankless task, so thanks, saves me a lot of egrepping.
Simon
The following rules should be replaced
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ postfix/policyd-weight\[[[:digit:]]+\]: (weighted check|decided action=PREPEND X-policyd-weight): ([_[:alpha:]]+=((-)?[[:digit:].]+|ERR) ?)+(\(check from: [^[:space:]]+ - helo: [^[:space:]]+ - helo-domain: [^[:space:]]+\) ([\()/_[:alnum:]]+=(-)?[[:digit:].]+ ?)+)?(; rate: (-)?[[:digit:].]+)?; *<client=[^[:space:]]+> <helo=[^[:space:]]+> <from=[^[:space:]]+> <to=[^[:space:]]+>(; rate: (-)?[[:digit:].]+)?(; delay: [[:digit:]]+s)? ?$
with this new rule:
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ postfix/policyd-weight\[[[:digit:]]+\]: (weighted check|decided action=PREPEND X-policyd-weight): ([_[:alpha:][:digit:]]+=((-)?[[:digit:].]+|ERR) ?)+(\(check from: [^[:space:]]+ - helo: [^[:space:]]+ - helo-domain: [^[:space:]]+\) ([\()/_[:alnum:]]+=(-)?[[:digit:].]+ ?)+)?(; rate: (-)?[[:digit:].]+)?; *<client=[^[:space:]]+> <helo=[^[:space:]]+> <from=[^[:space:]]+> <to=[^[:space:]]+>(; rate: (-)?[[:digit:].]+)?(; delay: [[:digit:]]+s)? ?$
There is an additional [:digit:] to cover checks having digits.
For example: weighted check: NOT_IN_SBL_XBL_SPAMHAUS=-1.5 NOT_IN_SPAMCOP=-1.5 HELO_IP_IN_CL16_SUBNET=-0.41
HELO_IP_IN_CL16_SUBNET cannot be matched with the rule from the package.