Re: [cobalt-users] Logcehck ignore

["Herby K" <mad1.z@xxxxxxx>]

----- Original Message ----- 
From: <twooly@xxxxxxxxx>
To: <cobalt-users@xxxxxxxxxxxxxxx>
Sent: Thursday, June 27, 2002 3:01 PM
Subject: [cobalt-users] Logcehck ignore


> I have logcheck working great but was wandering if I 
> could get some things out of the report because I know 
> what these entries are and don't care to see them all 
> the time.  For instance, every time the active monitor 
> connects and when my monitoring pc connects.  Here are 
> the entries in the report I would like to get rid of.
> 
> Jun 27 06:00:04 www sendmail[23210]: NOQUEUE: localhost 
> [127.0.0.1] did not issue MAIL/EXPN/VRFY/ETRN during 
> connection to MTA
> 
> Jun 27 06:25:05 www in.qpopper[24263]: EOF from  
> at "monitor pc ip" 
> ("monitor pc ip"): [0] 29 (Illegal seek); 0 (Success)
> 
> Jun 27 06:00:03 www proftpd[23208]: www.domain.com 
> (localhost[127.0.0.1]) - FTP session opened. 
> 
> Jun 27 06:25:13 www proftpd[24262]: "server ip" 
> ("monitor pc hostname"["monitor pc ip"]) - FTP session 
> opened. 
> 
> Jun 27 06:25:13 www proftpd[24262]: "server ip" 
> ("monitor pc hostname"["monitor pc ip"]) - FTP session 
> closed. 
> 
> Jun 27 06:25:03 www in.proftpd[24262]: connect 
> >from "monitor pc ip"
> 
> Jun 27 06:25:05 www in.qpopper[24263]: connect 
> >from "monitor pc ip"
> 
> Jun 27 06:25:05 www in.qpopper[24263]: (null) 
> at "monitor pc ip" ("monitor pc ip"): -ERR POP EOF or 
> I/O Error: 29 (Illegal seek); 0 (Success)
> 
> Any help would be appreciated.
> 
> --Todd


Hi!

edit the logcheck.ignore file

for example your 
> Jun 27 06:25:03 www in.proftpd[24262]: connect 
> >from "monitor pc ip"

is
*proftpd*: connect from .......

or 
in.qpopper*: (null) at ....

HTH
Herby