#705988 logcheck-database: Postfix rule updates for ignore.d.server

#705988#5
Date:
2013-04-23 09:04:10 UTC
From:
To:
Wheezy box with hostname validation checks and verify cache

I needed three rule changes to silence normal reports from postfix on Wheezy.

^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ postfix/smtpd\[[[:digit:]]+\]: warning: hostname [. _[:alnum:]-]+ does not resolve to address [[:digit:]\.]+(: Temporary failure in name resolution|: Name or service not known|: No address associated with hostname|)$

This rule includes text from existing rules, so perhaps those rules can be retired? The repetition of ": " in the text is unwieldy.

^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ postfix/verify\[[[:digit:]]+\]: close database /var/lib/postfix/verify_cache.db: No such file or directory \(possible Berkeley DB bug\)$

This rule addresses known spurious Berkeley DB warning.
http://tech.groups.yahoo.com/group/postfix-users/message/261323

^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ postfix/verify\[[[:digit:]]+\]: cache [-._:[:alnum:]/]+ full cleanup: retained=[[:digit:]]+ dropped=[[:digit:]]+ entries$

The cache name will by default begin "btree:/var/..." so I've added a ":" to existing rule after the word cache.

Sure maintaining these lists is a thankless task, so thanks, saves me a lot of egrepping.

 Simon

#705988#10
Date:
2014-10-20 19:07:28 UTC
From:
To:
The following rules should be replaced
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ postfix/policyd-weight\[[[:digit:]]+\]: (weighted check|decided action=PREPEND X-policyd-weight):  ([_[:alpha:]]+=((-)?[[:digit:].]+|ERR) ?)+(\(check from: [^[:space:]]+ - helo: [^[:space:]]+ - helo-domain: [^[:space:]]+\)  ([\()/_[:alnum:]]+=(-)?[[:digit:].]+ ?)+)?(; rate: (-)?[[:digit:].]+)?; *<client=[^[:space:]]+> <helo=[^[:space:]]+> <from=[^[:space:]]+> <to=[^[:space:]]+>(; rate: (-)?[[:digit:].]+)?(; delay: [[:digit:]]+s)? ?$

with this new rule:
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ postfix/policyd-weight\[[[:digit:]]+\]: (weighted check|decided action=PREPEND X-policyd-weight):  ([_[:alpha:][:digit:]]+=((-)?[[:digit:].]+|ERR) ?)+(\(check from: [^[:space:]]+ - helo: [^[:space:]]+ - helo-domain: [^[:space:]]+\)  ([\()/_[:alnum:]]+=(-)?[[:digit:].]+ ?)+)?(; rate: (-)?[[:digit:].]+)?; *<client=[^[:space:]]+> <helo=[^[:space:]]+> <from=[^[:space:]]+> <to=[^[:space:]]+>(; rate: (-)?[[:digit:].]+)?(; delay: [[:digit:]]+s)? ?$


There is an additional [:digit:] to cover checks having digits.
For example: weighted check:  NOT_IN_SBL_XBL_SPAMHAUS=-1.5 NOT_IN_SPAMCOP=-1.5 HELO_IP_IN_CL16_SUBNET=-0.41

HELO_IP_IN_CL16_SUBNET cannot be matched with the rule from the package.