2

I use logcheck for more than a decade and never had an issue. Now some messages are ignored and I just can't wrap my head around why.

My ignore.d.server/_self contains:

^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sudo\[[0-9]+\]: pam_unix\(sudo:session\): session (opened|closed) for user (root|logcheck)( by \(uid=0\))?$

However, I still keep getting emails multiple times a day containing:

Apr  6 19:41:09 radix sudo[4357]: pam_unix(sudo:session): session opened for user root by (uid=0)
Apr  6 19:41:09 radix sudo[4357]: pam_unix(sudo:session): session closed for user root

These should not appear. I am confident that my regex is fine -- you can see they match:

# echo 'Apr  6 19:41:09 radix sudo[4357]: pam_unix(sudo:session): session opened for user root by (uid=0)' | egrep '^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sudo\[[0-9]+\]: pam_unix\(sudo:session\): session (opened|closed) for user (root|logcheck)( by \(uid=0\))?$'
Apr  6 19:41:09 radix sudo[4357]: pam_unix(sudo:session): session opened for user root by (uid=0)
#
# echo 'Apr  6 19:41:09 radix sudo[4357]: pam_unix(sudo:session): session closed for user root' | egrep '^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sudo\[[0-9]+\]: pam_unix\(sudo:session\): session (opened|closed) for user (root|logcheck)( by \(uid=0\))?$'
Apr  6 19:41:09 radix sudo[4357]: pam_unix(sudo:session): session closed for user root
#

Why are these messages not filtered?

2
  • Absolutely nothing wrong with asking here, but you may find an answer more quickly in the future by using unix.stackexchange.com . You can search there now for an answer to this issue, but please don't double-post on both sites. – K7AAY Apr 2 '20 at 18:13
  • Are you sure the file is readable by the user logcheck? Despite using egrep, did you try your rules with logcheck-test? Are you sure, that you have configured logcheck to use the server rules? How do the lines before and after your pattern look like? – Strubbl Apr 7 '20 at 20:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.