Dear Maintainer,

with the release of jessie, I had to upgrade several machines from freeswan
(in wheezy) to strongswan (in jessie). After some struggling with
configuration files (my freeswan configuration was not compatible with
strongswan and I had to reconfigure my IPSec VPN from scratch) I got it to
work properly, and it now works flawlessly again.

However, I started receiving huge reports from logcheck from all machines in
the IPSec network.  I inspected the log files, and indeed all the log lines
being caught and reported by logcheck are absolutely normal, the bulk of
them being essentially charon doing its job of establishing connections,
checking certificates, rekeying etc..
I then set out to see what was missing from the regexps in the strongswan
ignore files in /etc/logcheck/ignore.d.* and to my surprise I noticed that
the "strongswan" files in there are actually verbatim copies from the
package of some old version of freeswan, the ignore patterns being about
pluto, the IKEv1 in freeswan.
I will now (with some patience) set out to create ignore patterns for my
local installations of stronswan, and install them on my machines.  If they
may be of any help, when done I can send them to you as a skeleton for
updated logcheck ignore files.  In the meanwhile, I recommend that you
either remove altogether the current stronswan files in the
/etc/logcheck/ignore.d.* directories, or replace them with empty
placeholders, until you have something more useful to put in them.

This problem affects versions in jessie, sid and experimental.

Thanks, bye
Giacomo Mulas

Am Freitag, 29. Mai 2015, 10:10:41 schrieben Sie:
It will be much appreciated if you can send your patterns - unfortunately, I am currently not using logcheck in production myself (time constraints), and therefore don't notice those issues.

best regards,
Rene

Dear maintainer,

as promised, please find attached the strongswan ignore file that I
concocted for my own use. It works for me, but it will most certainly need
some "massaging" to make it more general.
Also, it is rather inelegant: probably due to the way systemd works, all
charon messages to syslog get echoed verbatim also from ipsec, so they
appear twice and both must be caught by the ignore regexp. Therefore, due to
laziness, I made a copy of all charon regexps and substituted "charon:" with
ipsec[[[:digit:]]+]:
Of course, a better alternative would be to build a common regexp which
allows for both, but I am no regexp wizard and did not have the time to go
through the docs to find out how to do it more elegantly.

I hope it can be useful.

Bye
Giacomo