3

Getting these...

Jan  7 06:25:01 debian liblogging-stdlog:  [origin software="rsyslogd" swVersion="8.24.0" x-pid="551" x-info="http://www.rsyslog.com"] rsyslogd was HUPed

Debian default logcheck rule /etc/logcheck/ignore.d.server/rsyslog

^\w{3} [ :0-9]{11} [._[:alnum:]-]+ rsyslogd: \[origin software="rsyslogd" swVersion="[0-9.]+" x-pid="[0-9]+" x-info="http://www.rsyslog.com"\] rsyslogd was HUPed$

Custom rules tried /etc/logcheck/ignore.d.server/rsyslog-fix

^\w{3} [ :0-9]{11} [._[:alnum:]-]+ liblogging-stdlog:  \[origin software="rsyslogd" swVersion="[0-9.]+" x-pid="[0-9]+" x-info="http://www.rsyslog.com"\] rsyslogd was HUPed$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ liblogging-stdlog:  \[origin software="rsyslogd" swVersion="[0-9.]+" x-pid="[[:digit:]]+" x-info="http:\/\/www\.rsyslog\.com"\] rsyslogd was HUPed$

Any idea?? Thx!

2 Answers 2

1
  1. Check for whitespace or special characters (like CR) at the end of the log line; try including them by temporarily closing your pattern with .*$.
  2. Check /etc/logcheck/violations.d and /etc/logcheck/cracking.d for matching patterns, those directories have priority over /etc/logcheck/ignore.d.

egrep -f /etc/logcheck/DIR/FILE is a good tool to use for testing your rules.

1
  • Thanks the first command above seems to work, there was a missing space in my existing config... Tested using egrep as you suggested. Tried logcheck-test it doesn't work for me...
    – test3
    Jan 8, 2019 at 13:41
1

I simply added this line to /etc/rsyslog.conf and restarted it:

if ($msg contains "rsyslogd was HUPed") then stop

Good enough for me.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .