| Summary: | app-admin/logcheck: improved regexps for xlockmore | ||
|---|---|---|---|
| Product: | Gentoo Linux | Reporter: | Libor Polčák <libor+gentoobugs> |
| Component: | Current packages | Assignee: | Paweł Hajdan, Jr. (RETIRED) <phajdan.jr> |
| Status: | RESOLVED UPSTREAM | ||
| Severity: | enhancement | ||
| Priority: | Normal | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | http://lists.alioth.debian.org/pipermail/logcheck-devel/2011-May/005426.html | ||
| Whiteboard: | |||
| Package list: | Runtime testing required: | --- | |
| Attachments: | Fixed version of xlockmore file | ||
Created attachment 271613 [details]
Fixed version of xlockmore file
Thank you. This is not something to be changed by a distribution. Could you submit patches upstream? I've been doing just that, and it is generally easy. Please read http://www.debian.org/Bugs/Reporting for info how to open Debian bug reports (the package name is also logcheck; the project is just maintained by Debian). Read also http://wiki.logcheck.org/RuleSubmission for some more info about submitting rules (for example, it is important to include complete log lines from your system). I have sent them the patch. This bug can be closed. Thank you! |
app-admin/logcheck comes with several predefined regexps for different applications that are ignored if present in system logs. I believe that regexps for xlockmore installed to /etc/logcheck/ignore.d.workstation/xlockmore should be adjusted. Currently the display is specified as: [._[:alnum:]-]*:[[:digit:]]+(\.[[:digit:]]+) However, this regexp does not match for example ":0" So the content of the xlockmore file should be changed to: ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ xlock\[[0-9]+\]: Start: [._[:alnum:]-]+, [._[:alnum:]-]+, [._[:alnum:]-]*:[[:digit:]]+(\.[[:digit:]]+)?$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ xlock\[[0-9]+\]: Stop: [._[:alnum:]-]+, [._[:alnum:]-]+, [._[:alnum:]-]*:[[:digit:]]+(\.[[:digit:]]+)?, [[:digit:]]+m [[:digit:]]+s$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ xlock\[[0-9]+\]: xlock: expired\. closing down \(uid [[:digit:]]+\) on [._[:alnum:]-]*:[[:digit:]]+(\.[[:digit:]]+)?$ The only difference is the question mark in "[._[:alnum:]-]*:[[:digit:]]+(\.[[:digit:]]+)?" part of the regexps.