3

Getting these...

Jan  7 06:25:01 debian liblogging-stdlog:  [origin software="rsyslogd" swVersion="8.24.0" x-pid="551" x-info="http://www.rsyslog.com"] rsyslogd was HUPed

Debian default logcheck rule /etc/logcheck/ignore.d.server/rsyslog

^\w{3} [ :0-9]{11} [._[:alnum:]-]+ rsyslogd: \[origin software="rsyslogd" swVersion="[0-9.]+" x-pid="[0-9]+" x-info="http://www.rsyslog.com"\] rsyslogd was HUPed$

Custom rules tried /etc/logcheck/ignore.d.server/rsyslog-fix

^\w{3} [ :0-9]{11} [._[:alnum:]-]+ liblogging-stdlog:  \[origin software="rsyslogd" swVersion="[0-9.]+" x-pid="[0-9]+" x-info="http://www.rsyslog.com"\] rsyslogd was HUPed$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ liblogging-stdlog:  \[origin software="rsyslogd" swVersion="[0-9.]+" x-pid="[[:digit:]]+" x-info="http:\/\/www\.rsyslog\.com"\] rsyslogd was HUPed$

Any idea?? Thx!

1
  1. Check for whitespace or special characters (like CR) at the end of the log line; try including them by temporarily closing your pattern with .*$.
  2. Check /etc/logcheck/violations.d and /etc/logcheck/cracking.d for matching patterns, those directories have priority over /etc/logcheck/ignore.d.

egrep -f /etc/logcheck/DIR/FILE is a good tool to use for testing your rules.

| improve this answer | |
  • Thanks the first command above seems to work, there was a missing space in my existing config... Tested using egrep as you suggested. Tried logcheck-test it doesn't work for me... – test3 Jan 8 '19 at 13:41
1

I simply added this line to /etc/rsyslog.conf and restarted it:

if ($msg contains "rsyslogd was HUPed") then stop

Good enough for me.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.