2

Getting these...

Jan  7 06:25:01 debian liblogging-stdlog:  [origin software="rsyslogd" swVersion="8.24.0" x-pid="551" x-info="http://www.rsyslog.com"] rsyslogd was HUPed

Debian default logcheck rule /etc/logcheck/ignore.d.server/rsyslog

^\w{3} [ :0-9]{11} [._[:alnum:]-]+ rsyslogd: \[origin software="rsyslogd" swVersion="[0-9.]+" x-pid="[0-9]+" x-info="http://www.rsyslog.com"\] rsyslogd was HUPed$

Custom rules tried /etc/logcheck/ignore.d.server/rsyslog-fix

^\w{3} [ :0-9]{11} [._[:alnum:]-]+ liblogging-stdlog:  \[origin software="rsyslogd" swVersion="[0-9.]+" x-pid="[0-9]+" x-info="http://www.rsyslog.com"\] rsyslogd was HUPed$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ liblogging-stdlog:  \[origin software="rsyslogd" swVersion="[0-9.]+" x-pid="[[:digit:]]+" x-info="http:\/\/www\.rsyslog\.com"\] rsyslogd was HUPed$

Any idea?? Thx!

1
  1. Check for whitespace or special characters (like CR) at the end of the log line; try including them by temporarily closing your pattern with .*$.
  2. Check /etc/logcheck/violations.d and /etc/logcheck/cracking.d for matching patterns, those directories have priority over /etc/logcheck/ignore.d.

egrep -f /etc/logcheck/DIR/FILE is a good tool to use for testing your rules.

  • Thanks the first command above seems to work, there was a missing space in my existing config... Tested using egrep as you suggested. Tried logcheck-test it doesn't work for me... – test3 Jan 8 at 13:41

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.