app-admin/logcheck comes with several predefined regexps for different applications that are ignored if present in system logs. I believe that regexps for xlockmore installed to /etc/logcheck/ignore.d.workstation/xlockmore should be adjusted. Currently the display is specified as: [._[:alnum:]-]*:[[:digit:]]+(\.[[:digit:]]+) However, this regexp does not match for example ":0" So the content of the xlockmore file should be changed to: ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ xlock\[[0-9]+\]: Start: [._[:alnum:]-]+, [._[:alnum:]-]+, [._[:alnum:]-]*:[[:digit:]]+(\.[[:digit:]]+)?$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ xlock\[[0-9]+\]: Stop: [._[:alnum:]-]+, [._[:alnum:]-]+, [._[:alnum:]-]*:[[:digit:]]+(\.[[:digit:]]+)?, [[:digit:]]+m [[:digit:]]+s$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ xlock\[[0-9]+\]: xlock: expired\. closing down \(uid [[:digit:]]+\) on [._[:alnum:]-]*:[[:digit:]]+(\.[[:digit:]]+)?$ The only difference is the question mark in "[._[:alnum:]-]*:[[:digit:]]+(\.[[:digit:]]+)?" part of the regexps.
Created attachment 271613 [details] Fixed version of xlockmore file
Thank you. This is not something to be changed by a distribution. Could you submit patches upstream? I've been doing just that, and it is generally easy. Please read http://www.debian.org/Bugs/Reporting for info how to open Debian bug reports (the package name is also logcheck; the project is just maintained by Debian). Read also http://wiki.logcheck.org/RuleSubmission for some more info about submitting rules (for example, it is important to include complete log lines from your system).
I have sent them the patch. This bug can be closed.
Thank you!
