Debian Bug report logs - #275946
newline not recognized when logcheck sends emails

version graph

Package: logcheck; Maintainer for logcheck is Debian logcheck Team <logcheck-devel@lists.alioth.debian.org>; Source for logcheck is src:logcheck.

Reported by: Brendon Baumgartner <brendon@brendon.com>

Date: Mon, 11 Oct 2004 07:48:01 UTC

Severity: normal

Tags: moreinfo, unreproducible

Found in version 1.2.27

Fixed in version 1.2.47

Done: martin f krafft <madduck@debian.org>

Bug is archived. No further changes may be made.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, Debian logcheck Team <logcheck-devel@lists.alioth.debian.org>:
Bug#275946; Package logcheck. Full text and rfc822 format available.

Acknowledgement sent to Brendon Baumgartner <brendon@brendon.com>:
New Bug report received and forwarded. Copy sent to Debian logcheck Team <logcheck-devel@lists.alioth.debian.org>. Full text and rfc822 format available.

Message #5 received at submit@bugs.debian.org (full text, mbox):

From: Brendon Baumgartner <brendon@brendon.com>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: newline not recognized when logcheck sends emails
Date: Mon, 11 Oct 2004 00:42:06 -0700
Package: logcheck
Version: 1.2.27
Severity: normal

After creating a few local-* rules, Outlook now shows logcheck emails as
one long line. Reading the emails in a webmail client look fine though.

Note that this problem started after i created a few local-* rules. (as
far as i can tell)

Here is an example:

System Events
=-=-=-=-=-=-=
Oct 10 22:05:47 solara snmpd[7942]: Connection from 68.126.176.48 Oct 10
22:07:57 solara postfix/smtpd[14898]: lookup table has changed --
exiting Oct 10 22:10:49 solara snmpd[7942]: Connection from
68.126.176.48 Oct 10 22:15:48 solara snmpd[7942]: Connection from
68.126.176.48 Oct 10 22:20:47 solara snmpd[7942]: Connection from
68.126.176.48 Oct 10 22:25:15 solara pure-ftpd:
(?@adsl-68-126-239-39.dsl.pltn13.pacbell.net) [INFO] New connection from
adsl-68-126-239-39.dsl.pltn13.pacbell.net


-- System Information:
Debian Release: testing/unstable
  APT prefers testing
  APT policy: (990, 'testing'), (500, 'unstable')
Architecture: i386 (i686)
Kernel: Linux 2.4.22
Locale: LANG=C, LC_CTYPE=C

Versions of packages logcheck depends on:
ii  adduser          3.51                    Add and remove users and groups
ii  cron             3.0pl1-81               management of regular background p
ii  debconf [debconf 1.3.20                  Debian configuration management sy
ii  debianutils      2.6.1                   Miscellaneous utilities specific t
ii  lockfile-progs   0.1.10                  Programs for locking and unlocking
ii  logcheck-databas 1.2.27                  A database of system log rules for
ii  logtail          1.2.27                  Print log file lines that have not
ii  mailx            1:8.1.2-0.20031014cvs-1 A simple mail user agent
ii  perl             5.8.3-3                 Larry Wall's Practical Extraction 
ii  postfix [mail-tr 2.0.18-1                A high-performance mail transport 
ii  sysklogd [system 1.4.1-10                System Logging Daemon

-- debconf information:
  logcheck/changes: 
* logcheck/install-note: 



Information forwarded to debian-bugs-dist@lists.debian.org, Debian logcheck Team <logcheck-devel@lists.alioth.debian.org>:
Bug#275946; Package logcheck. Full text and rfc822 format available.

Acknowledgement sent to "Brendon Baumgartner" <brendon@brendon.com>:
Extra info received and forwarded to list. Copy sent to Debian logcheck Team <logcheck-devel@lists.alioth.debian.org>. Full text and rfc822 format available.

Message #10 received at 275946@bugs.debian.org (full text, mbox):

From: "Brendon Baumgartner" <brendon@brendon.com>
To: <275946@bugs.debian.org>
Subject: RE: Bug#275946: Acknowledgement (newline not recognized when logcheck sends emails)
Date: Mon, 11 Oct 2004 01:07:06 -0700
I upgraded to 1.2.28, same results.

Here are the rules I added.
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ perdition\[[0-9]+\]: Connect:
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pure-ftpd: [^[:space:]]+ \[NOTICE\]
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pure-ftpd: [^[:space:]]+ \[INFO\]
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ exact\[[0-9]+\]:
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ slapd\[[0-9]+\]:
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ snmpd\[[0-9]+\]: Connection from
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: IN-inet:IN
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: NEW TCP
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: SYN FLOOD:IN
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd\[[0-9]+\]: [A-Z0-9]+:
reject: RCPT from [^[:space:]]+: [0-9]{3} <[^[:space:]]+>: Relay access
denied; from=<[^[:space:]]*> to=<[^[:space:]]+> proto=(ESMTP|SMTP)
helo=<[^[:space:]]+>$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd\[[0-9]+\]: [A-Z0-9]+:
reject: RCPT from [^[:space:]]+: [0-9]{3} <[^[:space:]]+>: User unknown in
local recipient table; from=<[^[:space:]]*> to=<[^[:space:]]+>
proto=(ESMTP|SMTP) helo=<[^[:space:]]+>$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ cyrus/imapd\[[0-9]+\]: SQUAT failed.*$




Information forwarded to debian-bugs-dist@lists.debian.org, Debian logcheck Team <logcheck-devel@lists.alioth.debian.org>:
Bug#275946; Package logcheck. Full text and rfc822 format available.

Acknowledgement sent to maks attems <debian@sternwelten.at>:
Extra info received and forwarded to list. Copy sent to Debian logcheck Team <logcheck-devel@lists.alioth.debian.org>. Full text and rfc822 format available.

Message #15 received at 275946@bugs.debian.org (full text, mbox):

From: maks attems <debian@sternwelten.at>
To: Brendon Baumgartner <brendon@brendon.com>, 275946@bugs.debian.org
Subject: Re: [Logcheck-devel] Bug#275946: newline not recognized when logcheck sends emails
Date: Mon, 11 Oct 2004 11:59:57 +0200
tags 275946 moreinfo
thanks

On Mon, 11 Oct 2004, Brendon Baumgartner wrote:

> After creating a few local-* rules, Outlook now shows logcheck emails as
> one long line. Reading the emails in a webmail client look fine though.

that's a pretty bad mail client AFAIK.
 
> Note that this problem started after i created a few local-* rules. (as
> far as i can tell)

anyway please send in all those local-* files,
so we may be able to reproduce.
 
--
maks




Tags added: moreinfo Request was from maks attems <debian@sternwelten.at> to control@bugs.debian.org. Full text and rfc822 format available.

Information forwarded to debian-bugs-dist@lists.debian.org, Debian logcheck Team <logcheck-devel@lists.alioth.debian.org>:
Bug#275946; Package logcheck. Full text and rfc822 format available.

Acknowledgement sent to maks attems <debian@sternwelten.at>:
Extra info received and forwarded to list. Copy sent to Debian logcheck Team <logcheck-devel@lists.alioth.debian.org>. Full text and rfc822 format available.

Message #22 received at 275946@bugs.debian.org (full text, mbox):

From: maks attems <debian@sternwelten.at>
To: Brendon Baumgartner <brendon@brendon.com>, 275946@bugs.debian.org
Subject: Re: [Logcheck-devel] Bug#275946: Acknowledgement (newline not recognized when logcheck sends emails)
Date: Mon, 11 Oct 2004 12:09:32 +0200
On Mon, 11 Oct 2004, Brendon Baumgartner wrote:

> I upgraded to 1.2.28, same results.
> 
> Here are the rules I added.
> ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ perdition\[[0-9]+\]: Connect:
fixed in latest cvs.
> ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pure-ftpd: [^[:space:]]+ \[NOTICE\]
> ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pure-ftpd: [^[:space:]]+ \[INFO\]
please show us the loglines you want to ignore with those.
> ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ exact\[[0-9]+\]:
> ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ slapd\[[0-9]+\]:
> ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ snmpd\[[0-9]+\]: Connection from
pretty tooo generic, with those you trust any message of aboves 2 daemons,
again please send logmessages.
> ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: IN-inet:IN
> ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: NEW TCP
> ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: SYN FLOOD:IN
what that? iptables?
> ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd\[[0-9]+\]: [A-Z0-9]+:
> reject: RCPT from [^[:space:]]+: [0-9]{3} <[^[:space:]]+>: Relay access
> denied; from=<[^[:space:]]*> to=<[^[:space:]]+> proto=(ESMTP|SMTP)
> helo=<[^[:space:]]+>$
> ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd\[[0-9]+\]: [A-Z0-9]+:
> reject: RCPT from [^[:space:]]+: [0-9]{3} <[^[:space:]]+>: User unknown in
> local recipient table; from=<[^[:space:]]*> to=<[^[:space:]]+>
> proto=(ESMTP|SMTP) helo=<[^[:space:]]+>$
thanks now fixed in cvs,
we ignored NOQUEUE, which other are appearing, curious about the log messages?
> ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ cyrus/imapd\[[0-9]+\]: SQUAT failed.*$
please no '.*' without reasons,
logmessages would help.

i don't see a reason why your logcheck messages are linewrapped,
because of aboves new rules, could you please try to send the
local-* files in attached form and try to reproduce it with
an open and free mailer like mozilla.

thanks for your bugreport.

--
maks




Information forwarded to debian-bugs-dist@lists.debian.org, Debian logcheck Team <logcheck-devel@lists.alioth.debian.org>:
Bug#275946; Package logcheck. Full text and rfc822 format available.

Acknowledgement sent to "Brendon Baumgartner" <brendon@brendon.com>:
Extra info received and forwarded to list. Copy sent to Debian logcheck Team <logcheck-devel@lists.alioth.debian.org>. Full text and rfc822 format available.

Message #27 received at 275946@bugs.debian.org (full text, mbox):

From: "Brendon Baumgartner" <brendon@brendon.com>
To: "'maks attems'" <debian@sternwelten.at>, <275946@bugs.debian.org>
Subject: RE: [Logcheck-devel] Bug#275946: Acknowledgement (newline not recognized when logcheck sends emails)
Date: Mon, 11 Oct 2004 12:32:02 -0700
[Message part 1 (text/plain, inline)]
> From: maximilian attems [mailto:max@stro.at] On Behalf Of maks attems
> Sent: Monday, October 11, 2004 3:10 AM
> To: Brendon Baumgartner; 275946@bugs.debian.org
> Subject: Re: [Logcheck-devel] Bug#275946: Acknowledgement (newline not
> recognized when logcheck sends emails)
> 
> On Mon, 11 Oct 2004, Brendon Baumgartner wrote:
> 
> > I upgraded to 1.2.28, same results.
> >
> > Here are the rules I added.
> > ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ perdition\[[0-9]+\]: Connect:
> fixed in latest cvs.
> > ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pure-ftpd: [^[:space:]]+ \[NOTICE\]
> > ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pure-ftpd: [^[:space:]]+ \[INFO\]
> please show us the loglines you want to ignore with those.

I'm not sure what pureftp all shows, I haven't looked into it yet. I don't
want to see when someone logs in or when they upload a file. Based on what I
see below, dumping NOTICE and INFO is good.

Some pure-ftpd messages:
Oct 11 08:13:27 solara pure-ftpd: (?@ip68-104-126-23.lv.lv.cox.net) [INFO]
New connection from ip68-104-126-23.lv.lv.cox.net
Oct 11 08:13:28 solara pure-ftpd: (?@ip68-104-126-23.lv.lv.cox.net) [INFO]
www.tennis-league.com is now logged in
Oct 11 08:13:28 solara pure-ftpd:
(www.tennis-league.com@ip68-104-126-23.lv.lv.cox.net) [ERROR] Can't remove
directory: No such file or directory
Oct 11 08:13:28 solara pure-ftpd:
(www.tennis-league.com@ip68-104-126-23.lv.lv.cox.net) [INFO] Can't change
directory to //mm_casetest4291: No such file or directory
Oct 11 09:33:10 solara pure-ftpd:
(www.bballin.com@ip68-104-126-23.lv.lv.cox.net) [NOTICE]
/v0/ispman/domains/bballin.com/vhosts/www//htdocs/browsewaiverwire.php.LCK
downloaded  (40 bytes, 279.02KB/sec)
Oct 11 09:33:13 solara pure-ftpd:
(www.bballin.com@ip68-104-126-23.lv.lv.cox.net) [NOTICE]
/v0/ispman/domains/bballin.com/vhosts/www//htdocs/include/Ladder.php
uploaded  (5093 bytes, 15.15KB/sec)
Oct 11 10:16:54 solara pure-ftpd:
(www.bballin.com@ip68-104-126-23.lv.lv.cox.net) [INFO] Timeout - try typing
a little faster next time

> > ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ exact\[[0-9]+\]:
> > ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ slapd\[[0-9]+\]:
> > ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ snmpd\[[0-9]+\]: Connection from
> pretty tooo generic, with those you trust any message of aboves 2 daemons,
> again please send logmessages.

Yes, a little over the top, but slapd creates so much junk, I don't have
time to write proper rules, and I don't care about exact for the moment
either.

> > ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: IN-inet:IN
> > ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: NEW TCP
> > ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: SYN FLOOD:IN
> what that? iptables?

Yes. Iptables. I use another program check iptables. I do see ping floods in
logcheck emails still. I don't see a reason I need to though, but I've left
them for the moment.

Oct 11 10:53:50 solara kernel: IN-inet:IN=eth0 OUT=
MAC=00:90:27:17:b5:9b:00:90:69:46:3e:37:08:00 SRC=208.180.6.36
DST=208.184.76.97 LEN=48 TOS=0x00 PREC=0x00 TTL=118 ID=33483 DF PROTO=TCP
SPT=2998 DPT=135 WINDOW=16384 RES=0x00 SYN URGP=0

> > ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd\[[0-9]+\]: [A-Z0-9]+:
> > reject: RCPT from [^[:space:]]+: [0-9]{3} <[^[:space:]]+>: Relay access
> > denied; from=<[^[:space:]]*> to=<[^[:space:]]+> proto=(ESMTP|SMTP)
> > helo=<[^[:space:]]+>$
> > ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd\[[0-9]+\]: [A-Z0-9]+:
> > reject: RCPT from [^[:space:]]+: [0-9]{3} <[^[:space:]]+>: User unknown
> in
> > local recipient table; from=<[^[:space:]]*> to=<[^[:space:]]+>
> > proto=(ESMTP|SMTP) helo=<[^[:space:]]+>$
> thanks now fixed in cvs,
> we ignored NOQUEUE, which other are appearing, curious about the log
> messages?

Not sure what you're asking. Sorry.

Oct 11 10:58:09 solara postfix/smtpd[27917]: DA2331317B: reject: RCPT from
ip073254.fscwv.edu[129.71.73.254]: 550 <thomas@brendon.com>: User unknown in
local recipient table; from=<88@adelphia.net> to=<thomas@brendon.com>
proto=SMTP helo=<brendon.com>

> > ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ cyrus/imapd\[[0-9]+\]: SQUAT
> failed.*$
> please no '.*' without reasons,

Thanks, this was probably one of the first rules I did, while I was still
trying to figure things out. Fixed.

Oct 11 11:41:37 solara cyrus/imapd[27913]: SQUAT failed to open index file
Oct 11 11:41:37 solara cyrus/imapd[27913]: SQUAT failed

> logmessages would help.

I tried to include some for you.
 
> 
> thanks for your bugreport.

Glad to help. I know Outlook isn't desirable, but hey, it has a huge market
share :/

Tested with Outlook Express. Passed
Tested on another Outlook 2003, SP1. Failed. (same results)
Tested with Thunderbird. Passed.

I've attached my /etc/logcheck.

-- 
 _BB


[logcheck.tar.gz (application/octet-stream, attachment)]

Information forwarded to debian-bugs-dist@lists.debian.org, Debian logcheck Team <logcheck-devel@lists.alioth.debian.org>:
Bug#275946; Package logcheck. Full text and rfc822 format available.

Acknowledgement sent to "Brendon Baumgartner" <brendon@brendon.com>:
Extra info received and forwarded to list. Copy sent to Debian logcheck Team <logcheck-devel@lists.alioth.debian.org>. Full text and rfc822 format available.

Message #32 received at 275946@bugs.debian.org (full text, mbox):

From: "Brendon Baumgartner" <brendon@brendon.com>
To: <275946@bugs.debian.org>
Subject: last finding.
Date: Mon, 11 Oct 2004 14:35:49 -0700
My guess is if a rule doesn’t have a $ at the end if it, then the nearby
line will not display correctly in Outlook. I haven’t been able to pinpoint
it, but removing all my local* files causes the problem to go away.

 
-- 
 _BB
 





Information forwarded to debian-bugs-dist@lists.debian.org, Debian logcheck Team <logcheck-devel@lists.alioth.debian.org>:
Bug#275946; Package logcheck. Full text and rfc822 format available.

Acknowledgement sent to maks attems <debian@sternwelten.at>:
Extra info received and forwarded to list. Copy sent to Debian logcheck Team <logcheck-devel@lists.alioth.debian.org>. Full text and rfc822 format available.

Message #37 received at 275946@bugs.debian.org (full text, mbox):

From: maks attems <debian@sternwelten.at>
To: Brendon Baumgartner <brendon@brendon.com>
Cc: 275946@bugs.debian.org
Subject: Re: [Logcheck-devel] Bug#275946: last finding.
Date: Tue, 12 Oct 2004 01:13:13 +0200
sorry i'm already a bit sleepy, just 2 or 3 random thoughts.

On Mon, 11 Oct 2004, Brendon Baumgartner wrote:

> My guess is if a rule doesn’t have a $ at the end if it, then the nearby
> line will not display correctly in Outlook. I haven’t been able to pinpoint
> it, but removing all my local* files causes the problem to go away.

well that could be pinpointed easily,
just complete all your rules with a '.*$' at the end
i no it's _not_ pretty, but shouldn't change the rules themself.

would be cool to see which local-foo file is causing damage?

i'm still puzzled that local rules make a difference on the logcheck
output, as they are run through same code as others,
could you send one of those files, are you shure they don't contain
some funny dos strings aka '
' don't know if you will see this one
in your mailer :-P

--
maks

ps anyways thanks for some loglines, will take care tomorrow.




Information forwarded to debian-bugs-dist@lists.debian.org, Debian logcheck Team <logcheck-devel@lists.alioth.debian.org>:
Bug#275946; Package logcheck. Full text and rfc822 format available.

Acknowledgement sent to maks attems <debian@sternwelten.at>:
Extra info received and forwarded to list. Copy sent to Debian logcheck Team <logcheck-devel@lists.alioth.debian.org>. Full text and rfc822 format available.

Message #42 received at 275946@bugs.debian.org (full text, mbox):

From: maks attems <debian@sternwelten.at>
To: Brendon Baumgartner <brendon@brendon.com>
Cc: 275946@bugs.debian.org
Subject: Re: [Logcheck-devel] Bug#275946: Acknowledgement (newline not recognized when logcheck sends emails)
Date: Tue, 12 Oct 2004 18:10:27 +0200
[Message part 1 (text/plain, inline)]
On Mon, 11 Oct 2004, Brendon Baumgartner wrote:

> > From: maximilian attems On Behalf Of maks attems
> > 
> > On Mon, 11 Oct 2004, Brendon Baumgartner wrote:
> > 
> > > I upgraded to 1.2.28, same results.
> > >
> > > Here are the rules I added.
> > > ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ perdition\[[0-9]+\]: Connect:
> > fixed in latest cvs.
> > > ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pure-ftpd: [^[:space:]]+ \[NOTICE\]
> > > ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pure-ftpd: [^[:space:]]+ \[INFO\]
> > please show us the loglines you want to ignore with those.
> 
> I'm not sure what pureftp all shows, I haven't looked into it yet. I don't
> want to see when someone logs in or when they upload a file. Based on what I
> see below, dumping NOTICE and INFO is good.

fully agreed, worked out some preliminary rules out of posted messages,
used '.+' to match dirs as they can also contain spaces.
please try attached local-pureftp.
 
> Yes, a little over the top, but slapd creates so much junk, I don't have
> time to write proper rules, and I don't care about exact for the moment
> either.

ok left as is,
afaik slapd has very different loglevels with increasing ouput.
 
> > > ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: IN-inet:IN
> > > ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: NEW TCP
> > > ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: SYN FLOOD:IN
> > what that? iptables?
> 
> Yes. Iptables. I use another program check iptables. I do see ping floods in
> logcheck emails still. I don't see a reason I need to though, but I've left
> them for the moment.

hmm not shure if iptables logs into syslog in standard conf,
there for left for some iptables gurus.
 
> > thanks now fixed in cvs,
> > we ignored NOQUEUE, which other are appearing, curious about the log
> > messages?
> 
> Not sure what you're asking. Sorry.
> 
> Oct 11 10:58:09 solara postfix/smtpd[27917]: DA2331317B: reject: RCPT from
> ip073254.fscwv.edu[129.71.73.254]: 550 <thomas@brendon.com>: User unknown in
> local recipient table; from=<88@adelphia.net> to=<thomas@brendon.com>
> proto=SMTP helo=<brendon.com>

thanks this answered my question,
added new rule to cvs logcheck-postfix for aboves,
and fixed other reject lines.
 
> Thanks, this was probably one of the first rules I did, while I was still
> trying to figure things out. Fixed.
> 
> Oct 11 11:41:37 solara cyrus/imapd[27913]: SQUAT failed to open index file
> Oct 11 11:41:37 solara cyrus/imapd[27913]: SQUAT failed

strange there are rules for that message in
/etc/logcheck/violations.ignore.d/logcheck-cyrus .
could you check it's permission?
in what section do aboves rule appear, "security events"
or "system events"?
 
> Glad to help. I know Outlook isn't desirable, but hey, it has a huge market
> share :/
> 
> Tested with Outlook Express. Passed
> Tested on another Outlook 2003, SP1. Failed. (same results)
> Tested with Thunderbird. Passed.

i still don't understand how that does correlate with
mails containtaing less messages due local-* rules.
 
> I've attached my /etc/logcheck.

ooh i had overlooked that, found nothing suspicious in your local files.
 


--
maks
[local-pureftp (text/plain, attachment)]

Information forwarded to debian-bugs-dist@lists.debian.org, Debian logcheck Team <logcheck-devel@lists.alioth.debian.org>:
Bug#275946; Package logcheck. Full text and rfc822 format available.

Acknowledgement sent to maks attems <debian@sternwelten.at>:
Extra info received and forwarded to list. Copy sent to Debian logcheck Team <logcheck-devel@lists.alioth.debian.org>. Full text and rfc822 format available.

Message #47 received at 275946@bugs.debian.org (full text, mbox):

From: maks attems <debian@sternwelten.at>
To: Brendon Baumgartner <brendon@brendon.com>, 275946@bugs.debian.org
Subject: Re: [Logcheck-devel] Bug#275946: newline not recognized when logcheck sends emails
Date: Thu, 21 Oct 2004 20:01:51 +0200
tags 275946 unreproducible
thanks

On Mon, 11 Oct 2004, Brendon Baumgartner wrote:

> After creating a few local-* rules, Outlook now shows logcheck emails as
> one long line. Reading the emails in a webmail client look fine though.

please pinpoint this problem which rule is creating trouble.
as i'm not able to reproduce this line-wrap problem,
i may have to close that bug.

anyways thanks for your bug report
a++ maks




Tags added: unreproducible Request was from maks attems <debian@sternwelten.at> to control@bugs.debian.org. Full text and rfc822 format available.

Information forwarded to debian-bugs-dist@lists.debian.org, Debian logcheck Team <logcheck-devel@lists.alioth.debian.org>:
Bug#275946; Package logcheck. Full text and rfc822 format available.

Acknowledgement sent to "Brendon Baumgartner" <brendon@brendon.com>:
Extra info received and forwarded to list. Copy sent to Debian logcheck Team <logcheck-devel@lists.alioth.debian.org>. Full text and rfc822 format available.

Message #54 received at 275946@bugs.debian.org (full text, mbox):

From: "Brendon Baumgartner" <brendon@brendon.com>
To: "'maks attems'" <debian@sternwelten.at>
Cc: <275946@bugs.debian.org>
Subject: RE: [Logcheck-devel] Bug#275946: newline not recognized when logcheck sends emails
Date: Fri, 22 Oct 2004 20:57:15 -0700
[Message part 1 (text/plain, inline)]
Started this discussion, might as well try and finish it. :)

Watch closely. The 2043 does NOT have the SLAPD rules and the 20:45 does.
The report generated by the ladder has a linefeed problem. It seems to me
that the slapd rules match a carriage return or line feed that the other
rules do not. 

In summary:
2043 report: good. Even where slapd and kernel messages are mixed together.
2045 report: bad.

Let me know what you think.
Brendon

(note, I only showed my additions. I removed all my rules that looked like
they could match a line feed)

The 20:43 report has these rules:
#
#
#
./ignore.d.server/local-perdition
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ perdition\[[0-9]+\]: Connect:
[.0-9]+->[.0-9]+$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ perdition\[[0-9]+\]: Fatal error piping
data. Exiting child\.$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ perdition\[[0-9]+\]: Closing NULL
session: [.0-9]+->[.0-9]+ username=\(null\)$

./ignore.d.server/local-postfix
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd\[[0-9]+\]: table
hash:/var/lib/exact/relay\(0,100\) has changed -- restarting$
^COMMENT\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtp\[[0-9]+\]: [0-9A-Z]+:
lost connection with [^[:space:]]+ while sending end of data -- message may
be sent more than once$

./ignore.d.server/local-cron
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ cron\(pam_unix\)\[[0-9]+\]: session
closed for user logcheck$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ cron\(pam_unix\)\[[0-9]+\]: session
opened for user logcheck by \(uid=0\)$

./ignore.d.server/local-sshd
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: syslogin_perform_logout:
logout\(\) returned an error$

./ignore.d.server/local-pure-ftpd
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pure-ftpd: \(\?@[._[:alnum:]-]+\)
\[INFO\] New connection from [._[:alnum:]-]+$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pure-ftpd: \(\?@[._[:alnum:]-]+\)
\[INFO\] [._[:alnum:]-]+ is now logged in$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pure-ftpd:
\([\?._[:alnum:]-]+@[._[:alnum:]-]+\) \[INFO\] Logout\.$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pure-ftpd:
\([._[:alnum:]-]+@[._[:alnum:]-]+\) \[INFO\] Timeout - try typing a little
faster next time$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pure-ftpd:
\([._[:alnum:]-]+@[._[:alnum:]-]+\) \[INFO\] Can't change directory to .+:
No such file or directory$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pure-ftpd:
\([._[:alnum:]-]+@[._[:alnum:]-]+\) \[INFO\] Can't change directory to .+:
Not a directory$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pure-ftpd:
\([._[:alnum:]-]+@[._[:alnum:]-]+\) \[INFO\] Timeout \(no new data for
[0-9]+ seconds\)$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pure-ftpd:
\([._[:alnum:]-]+@[._[:alnum:]-]+\) \[NOTICE\] .+ (up|down)loaded  \([0-9]+
bytes, [0-9]+.[0-9]+KB/sec\)$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pure-ftpd:
\([._[:alnum:]-]+@[._[:alnum:]-]+\) \[NOTICE\] Deleted .+$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pure-ftpd:
\([._[:alnum:]-]+@[._[:alnum:]-]+\) \[NOTICE\] File successfully renamed or
moved: \[.+\]->\[.+\]$

./ignore.d.server/local-exact
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ exact\[[0-9]+\]: authorising
[^[:space:]]+ at [.0-9]+$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ exact\[[0-9]+\]: cleaning db file$

./ignore.d.server/local-snmpd
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ snmpd\[[0-9]+\]: Connection from [.0-9]+$

./violations.ignore.d/local-postfix
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd\[[0-9]+\]: [A-Z0-9]+:
reject: RCPT from [^[:space:]]+: [0-9]{3} <[^[:space:]]+>: Relay access
denied; from=<[^[:space:]]*> to=<[^[:space:]]+> proto=(ESMTP|SMTP)
helo=<[^[:space:]]+>$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd\[[0-9]+\]: [A-Z0-9]+:
reject: RCPT from [^[:space:]]+: [0-9]{3} <[^[:space:]]+>: User unknown in
local recipient table; from=<[^[:space:]]*> to=<[^[:space:]]+>
proto=(ESMTP|SMTP) helo=<[^[:space:]]+>$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtp\[[0-9]+\]: [A-Z0-9]+:
to=<[^[:space:]]+>, relay=[^[:space:]]+, delay=[0-9]+, status=deferred
\(host [^[:space:]]+ refused to talk to me: [^[:space:]]+ 554 Access
denied\)$

./violations.ignore.d/local-pure-ftpd
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pure-ftpd:
\([._[:alnum:]-]+@[._[:alnum:]-]+\) \[ERROR\] Can't open .+: No such file or
directory$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pure-ftpd:
\([._[:alnum:]-]+@[._[:alnum:]-]+\) \[ERROR\] Can't remove directory: No
such file or directory$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pure-ftpd: \(\?@[._[:alnum:]-]+\)
\[DEBUG\] This is a private system - No anonymous login$

./violations.ignore.d/local-cyrus
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ cyrus/imapd\[[0-9]+\]: SQUAT failed$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ cyrus/imapd\[[0-9]+\]: SQUAT failed to
open index file$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ cyrus/lmtpd\[[0-9]+\]: DBERROR db3:
[0-9]+ lockers$



#
#
#
The 20:45 has these:

./ignore.d.server/local-perdition
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ perdition\[[0-9]+\]: Connect:
[.0-9]+->[.0-9]+$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ perdition\[[0-9]+\]: Fatal error piping
data. Exiting child\.$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ perdition\[[0-9]+\]: Closing NULL
session: [.0-9]+->[.0-9]+ username=\(null\)$

./ignore.d.server/local-postfix
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd\[[0-9]+\]: table
hash:/var/lib/exact/relay\(0,100\) has changed -- restarting$
^COMMENT\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtp\[[0-9]+\]: [0-9A-Z]+:
lost connection with [^[:space:]]+ while sending end of data -- message may
be sent more than once$

./ignore.d.server/local-cron
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ cron\(pam_unix\)\[[0-9]+\]: session
closed for user logcheck$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ cron\(pam_unix\)\[[0-9]+\]: session
opened for user logcheck by \(uid=0\)$

./ignore.d.server/local-sshd
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: syslogin_perform_logout:
logout\(\) returned an error$

./ignore.d.server/local-pure-ftpd
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pure-ftpd: \(\?@[._[:alnum:]-]+\)
\[INFO\] New connection from [._[:alnum:]-]+$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pure-ftpd: \(\?@[._[:alnum:]-]+\)
\[INFO\] [._[:alnum:]-]+ is now logged in$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pure-ftpd:
\([\?._[:alnum:]-]+@[._[:alnum:]-]+\) \[INFO\] Logout\.$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pure-ftpd:
\([._[:alnum:]-]+@[._[:alnum:]-]+\) \[INFO\] Timeout - try typing a little
faster next time$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pure-ftpd:
\([._[:alnum:]-]+@[._[:alnum:]-]+\) \[INFO\] Can't change directory to .+:
No such file or directory$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pure-ftpd:
\([._[:alnum:]-]+@[._[:alnum:]-]+\) \[INFO\] Can't change directory to .+:
Not a directory$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pure-ftpd:
\([._[:alnum:]-]+@[._[:alnum:]-]+\) \[INFO\] Timeout \(no new data for
[0-9]+ seconds\)$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pure-ftpd:
\([._[:alnum:]-]+@[._[:alnum:]-]+\) \[NOTICE\] .+ (up|down)loaded  \([0-9]+
bytes, [0-9]+.[0-9]+KB/sec\)$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pure-ftpd:
\([._[:alnum:]-]+@[._[:alnum:]-]+\) \[NOTICE\] Deleted .+$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pure-ftpd:
\([._[:alnum:]-]+@[._[:alnum:]-]+\) \[NOTICE\] File successfully renamed or
moved: \[.+\]->\[.+\]$

./ignore.d.server/local-exact
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ exact\[[0-9]+\]: authorising
[^[:space:]]+ at [.0-9]+$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ exact\[[0-9]+\]: cleaning db file$

./ignore.d.server/local-slapd
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ slapd\[[0-9]+\]:

./ignore.d.server/local-snmpd
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ snmpd\[[0-9]+\]: Connection from [.0-9]+$

./violations.ignore.d/local-postfix
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd\[[0-9]+\]: [A-Z0-9]+:
reject: RCPT from [^[:space:]]+: [0-9]{3} <[^[:space:]]+>: Relay access
denied; from=<[^[:space:]]*> to=<[^[:space:]]+> proto=(ESMTP|SMTP)
helo=<[^[:space:]]+>$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd\[[0-9]+\]: [A-Z0-9]+:
reject: RCPT from [^[:space:]]+: [0-9]{3} <[^[:space:]]+>: User unknown in
local recipient table; from=<[^[:space:]]*> to=<[^[:space:]]+>
proto=(ESMTP|SMTP) helo=<[^[:space:]]+>$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtp\[[0-9]+\]: [A-Z0-9]+:
to=<[^[:space:]]+>, relay=[^[:space:]]+, delay=[0-9]+, status=deferred
\(host [^[:space:]]+ refused to talk to me: [^[:space:]]+ 554 Access
denied\)$

./violations.ignore.d/local-pure-ftpd
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pure-ftpd:
\([._[:alnum:]-]+@[._[:alnum:]-]+\) \[ERROR\] Can't open .+: No such file or
directory$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pure-ftpd:
\([._[:alnum:]-]+@[._[:alnum:]-]+\) \[ERROR\] Can't remove directory: No
such file or directory$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pure-ftpd: \(\?@[._[:alnum:]-]+\)
\[DEBUG\] This is a private system - No anonymous login$

./violations.ignore.d/local-cyrus
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ cyrus/imapd\[[0-9]+\]: SQUAT failed$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ cyrus/imapd\[[0-9]+\]: SQUAT failed to
open index file$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ cyrus/lmtpd\[[0-9]+\]: DBERROR db3:
[0-9]+ lockers$

./violations.ignore.d/local-slapd
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ slapd\[[0-9]+\]:

 
-- 
 _BB
[Message part 2 (message/rfc822, attachment)]
[Message part 3 (message/rfc822, attachment)]

Information forwarded to debian-bugs-dist@lists.debian.org, Debian logcheck Team <logcheck-devel@lists.alioth.debian.org>:
Bug#275946; Package logcheck. Full text and rfc822 format available.

Acknowledgement sent to maks attems <debian@sternwelten.at>:
Extra info received and forwarded to list. Copy sent to Debian logcheck Team <logcheck-devel@lists.alioth.debian.org>. Full text and rfc822 format available.

Message #59 received at 275946@bugs.debian.org (full text, mbox):

From: maks attems <debian@sternwelten.at>
To: Brendon Baumgartner <brendon@brendon.com>
Cc: 275946@bugs.debian.org
Subject: Re: [Logcheck-devel] Bug#275946: newline not recognized when logcheck sends emails
Date: Mon, 25 Oct 2004 22:05:45 +0200
On Fri, 22 Oct 2004, Brendon Baumgartner wrote:

> Started this discussion, might as well try and finish it. :)

thanks for feeback. :)
 
> Watch closely. The 2043 does NOT have the SLAPD rules and the 20:45 does.
> The report generated by the ladder has a linefeed problem. It seems to me
> that the slapd rules match a carriage return or line feed that the other
> rules do not. 
> 
> In summary:
> 2043 report: good. Even where slapd and kernel messages are mixed together.
> 2045 report: bad.
> 
> Let me know what you think.
> Brendon
> 
> (note, I only showed my additions. I removed all my rules that looked like
> they could match a line feed)
<snipp rules>

ok now we have something we can poke on even if looks wired
that removing more messages causes this line-wrap problem.

could you show as the output of
sed -e 's/[[:space:]]+$//' /var/log/syslog | egrep --text slapd | \
egrep --text -v '^\w{3} [ :0-9]{11} [._[:alnum:]-]+ slapd\[[0-9]+\]:'

as i have hands on an ldap server i'll may also try,
maybe a better idea comes up till then.

a++ maks





Information forwarded to debian-bugs-dist@lists.debian.org, Debian logcheck Team <logcheck-devel@lists.alioth.debian.org>:
Bug#275946; Package logcheck. Full text and rfc822 format available.

Acknowledgement sent to "Brendon Baumgartner" <brendon@brendon.com>:
Extra info received and forwarded to list. Copy sent to Debian logcheck Team <logcheck-devel@lists.alioth.debian.org>. Full text and rfc822 format available.

Message #64 received at 275946@bugs.debian.org (full text, mbox):

From: "Brendon Baumgartner" <brendon@brendon.com>
To: "'maks attems'" <debian@sternwelten.at>, <275946@bugs.debian.org>
Subject: RE: [Logcheck-devel] Bug#275946: newline not recognized when logcheck sends emails
Date: Mon, 25 Oct 2004 13:28:19 -0700
> From: maximilian attems [mailto:max@stro.at] On Behalf Of maks attems
> Sent: Monday, October 25, 2004 1:06 PM
> To: Brendon Baumgartner
> Cc: 275946@bugs.debian.org
> Subject: Re: [Logcheck-devel] Bug#275946: newline not recognized when
> logcheck sends emails
> 
> On Fri, 22 Oct 2004, Brendon Baumgartner wrote:
> 
> > Started this discussion, might as well try and finish it. :)
> 
> thanks for feeback. :)
> 
> > Watch closely. The 2043 does NOT have the SLAPD rules and the 20:45
> does.
> > The report generated by the ladder has a linefeed problem. It seems to
> me
> > that the slapd rules match a carriage return or line feed that the other
> > rules do not.
> >
> > In summary:
> > 2043 report: good. Even where slapd and kernel messages are mixed
> together.
> > 2045 report: bad.
> >
> > Let me know what you think.
> > Brendon
> >
> > (note, I only showed my additions. I removed all my rules that looked
> like
> > they could match a line feed)
> <snipp rules>
> 
> ok now we have something we can poke on even if looks wired
> that removing more messages causes this line-wrap problem.
> 
> could you show as the output of
> sed -e 's/[[:space:]]+$//' /var/log/syslog | egrep --text slapd | \
> egrep --text -v '^\w{3} [ :0-9]{11} [._[:alnum:]-]+ slapd\[[0-9]+\]:'
> 
> as i have hands on an ldap server i'll may also try,
> maybe a better idea comes up till then.
> 

solara:/etc/mon# sed -e 's/[[:space:]]+$//' /var/log/syslog | egrep --text
slapd |  egrep --text -v '^\w{3} [ :0-9]{11} [._[:alnum:]-]+
slapd\[[0-9]+\]:'
solara:/etc/mon# 
solara:/etc/mon# sed -e 's/[[:space:]]+$//' /var/log/syslog | egrep --text
slapd         
solara:/etc/mon#




Information forwarded to debian-bugs-dist@lists.debian.org, Debian logcheck Team <logcheck-devel@lists.alioth.debian.org>:
Bug#275946; Package logcheck. Full text and rfc822 format available.

Acknowledgement sent to maximilian attems <debian@sternwelten.at>:
Extra info received and forwarded to list. Copy sent to Debian logcheck Team <logcheck-devel@lists.alioth.debian.org>. Full text and rfc822 format available.

Message #69 received at 275946@bugs.debian.org (full text, mbox):

From: maximilian attems <debian@sternwelten.at>
To: Brendon Baumgartner <brendon@brendon.com>
Cc: 275946@bugs.debian.org
Subject: Re: [Logcheck-devel] Bug#275946: newline not recognized when logcheck sends emails
Date: Sat, 26 Feb 2005 00:12:02 +0100
as nobody else gave input on that matter,
i'll try to dig further...

On Fri, 22 Oct 2004, Brendon Baumgartner wrote:

> Started this discussion, might as well try and finish it. :)
> 
> Watch closely. The 2043 does NOT have the SLAPD rules and the 20:45 does.
> The report generated by the ladder has a linefeed problem. It seems to me
> that the slapd rules match a carriage return or line feed that the other
> rules do not. 
> 
> In summary:
> 2043 report: good. Even where slapd and kernel messages are mixed together.
> 2045 report: bad.
> 
> Let me know what you think.
> Brendon

a possiblity would be to set "loglevel        0",
but i guess you have reasons not to do so. ;-)

what's your default locales?
is it an utf8, does a change to "oldstyle" iso help?
 
perhaps another to me unkown parameter changed your problem?

thanks for your feedback. :)

a++ maks




Information forwarded to debian-bugs-dist@lists.debian.org, Debian logcheck Team <logcheck-devel@lists.alioth.debian.org>:
Bug#275946; Package logcheck. Full text and rfc822 format available.

Acknowledgement sent to "Brendon Baumgartner" <brendon@brendon.com>:
Extra info received and forwarded to list. Copy sent to Debian logcheck Team <logcheck-devel@lists.alioth.debian.org>. Full text and rfc822 format available.

Message #74 received at 275946@bugs.debian.org (full text, mbox):

From: "Brendon Baumgartner" <brendon@brendon.com>
To: "'maximilian attems'" <debian@sternwelten.at>
Cc: <275946@bugs.debian.org>
Subject: RE: [Logcheck-devel] Bug#275946: newline not recognized when logcheck sends emails
Date: Sat, 26 Feb 2005 13:06:57 -0800
> -----Original Message-----
> From: maximilian attems [mailto:debian@sternwelten.at]
> Sent: Friday, February 25, 2005 3:12 PM
> To: Brendon Baumgartner
> Cc: 275946@bugs.debian.org
> Subject: Re: [Logcheck-devel] Bug#275946: newline not recognized when
> logcheck sends emails
> 
> as nobody else gave input on that matter,
> i'll try to dig further...
> 
> On Fri, 22 Oct 2004, Brendon Baumgartner wrote:
> 
> > Started this discussion, might as well try and finish it. :)
> >
> > Watch closely. The 2043 does NOT have the SLAPD rules and the 20:45
> does.
> > The report generated by the ladder has a linefeed problem. It seems to
> me
> > that the slapd rules match a carriage return or line feed that the other
> > rules do not.
> >
> > In summary:
> > 2043 report: good. Even where slapd and kernel messages are mixed
> together.
> > 2045 report: bad.
> >
> > Let me know what you think.
> > Brendon
> 
> a possiblity would be to set "loglevel        0",
> but i guess you have reasons not to do so. ;-)

Yes, I have since set loglevel to 0 in slapd.conf

> what's your default locales?
> is it an utf8, does a change to "oldstyle" iso help?

I don't use/change this. LC_* is not set in the environment. Running locale
says everything = "POSIX"

> perhaps another to me unkown parameter changed your problem?

I'm running deb package 1.2.33. I still have the line wrapping problem when
reading the emails in outlook. I've gotten use to it :)

-- 
 _BB
 





Reply sent to martin f krafft <madduck@debian.org>:
You have taken responsibility. Full text and rfc822 format available.

Notification sent to Brendon Baumgartner <brendon@brendon.com>:
Bug acknowledged by developer. Full text and rfc822 format available.

Message #79 received at 275946-done@bugs.debian.org (full text, mbox):

From: martin f krafft <madduck@debian.org>
To: 275946-done@bugs.debian.org
Subject: closing for now
Date: Sun, 8 Oct 2006 16:23:54 +0200
[Message part 1 (text/plain, inline)]
Version: 1.2.47

I cannot imagine how the format of a rule would influence what
logcheck sends. After all, the log lines are passed through
unaltered, unless a filter matches.

I am closing this bug due to inactivity. Please try a new logcheck
versions. If the bug persists and you can reproduce it with
a standards-compliant mail client, please reopen it.

-- 
 .''`.   martin f. krafft <madduck@debian.org>
: :'  :  proud Debian developer, author, administrator, and user
`. `'`   http://people.debian.org/~madduck - http://debiansystem.info
  `-  Debian - when you have better things to do than fixing systems
[signature.asc (application/pgp-signature, inline)]

Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Mon, 25 Jun 2007 11:18:25 GMT) Full text and rfc822 format available.

Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Thu Apr 24 04:56:22 2014; Machine Name: buxtehude.debian.org

Debian Bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.