2

Getting these...

Jan  7 06:25:01 debian liblogging-stdlog:  [origin software="rsyslogd" swVersion="8.24.0" x-pid="551" x-info="http://www.rsyslog.com"] rsyslogd was HUPed

Debian default logcheck rule /etc/logcheck/ignore.d.server/rsyslog

^\w{3} [ :0-9]{11} [._[:alnum:]-]+ rsyslogd: \[origin software="rsyslogd" swVersion="[0-9.]+" x-pid="[0-9]+" x-info="http://www.rsyslog.com"\] rsyslogd was HUPed$

Custom rules tried /etc/logcheck/ignore.d.server/rsyslog-fix

^\w{3} [ :0-9]{11} [._[:alnum:]-]+ liblogging-stdlog:  \[origin software="rsyslogd" swVersion="[0-9.]+" x-pid="[0-9]+" x-info="http://www.rsyslog.com"\] rsyslogd was HUPed$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ liblogging-stdlog:  \[origin software="rsyslogd" swVersion="[0-9.]+" x-pid="[[:digit:]]+" x-info="http:\/\/www\.rsyslog\.com"\] rsyslogd was HUPed$

Any idea?? Thx!

1
  1. Check for whitespace or special characters (like CR) at the end of the log line; try including them by temporarily closing your pattern with .*$.
  2. Check /etc/logcheck/violations.d and /etc/logcheck/cracking.d for matching patterns, those directories have priority over /etc/logcheck/ignore.d.

egrep -f /etc/logcheck/DIR/FILE is a good tool to use for testing your rules.

  • Thanks the first command above seems to work, there was a missing space in my existing config... Tested using egrep as you suggested. Tried logcheck-test it doesn't work for me... – test3 Jan 8 at 13:41

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.