Hi,
wonderful, no I can go further.
Problem is, I use SuSE. But with the sources on the debian-page I can use
it.
Thanks
Wolfgang
> -----Ursprüngliche Nachricht-----
> Von: Dickenson, Steven [mailto:sdickenson@keyschool.org]
> Gesendet: Dienstag, 25. Februar 2003 15:59
> An: 'exim-users@???'
> Betreff: RE: [Exim] Logcheck configuration files
>
>
> Well, logcheck used to be part of the Abacus security
> project. However, I
> believe it was abandoned by its author about 9 months ago. The Debian
> package maintainer started doing some work on the code,
> adding features and
> fixing reported bugs. You can grab the source TGZ file from
> the Debian
> project page, as well as the Debian specific diffs, and try
> to kludge a
> generic package together with that.
>
> http://packages.debian.org/stable/admin/logcheck.html
>
> I just used apt-get. Man I love Debian.
>
> Steven
> ---
> Steven Dickenson <sdickenson@???>
> Network Administrator
> The Key School, Annapolis Maryland
>
> -----Original Message-----
> From: Lumpp, Wolfgang [mailto:wol@msc-ge.com]
> Sent: Tuesday, February 25, 2003 4:00 AM
> To: exim-users@???
> Subject: AW: [Exim] Logcheck configuration files
>
>
> Hi,
>
> where can I download the logcheck/logsentry?
> I've tried several links, but all dead :-(
>
> Thanks
> Wolfgang
>
> > -----Ursprüngliche Nachricht-----
> > Von: Marc MERLIN [mailto:marc_news@merlins.org]
> > Gesendet: Freitag, 21. Februar 2003 22:19
> > An: Dickenson, Steven
> > Cc: 'Exim Users (exim-users@???)'
> > Betreff: Re: [Exim] Logcheck configuration files
> >
> >
> > On Fri, Feb 21, 2003 at 04:03:22PM -0500, Dickenson, Steven wrote:
> > > Does anyone have some sample logcheck files for use with
> > Exim that you'd
> > > like to share? I'd particularly like to see those from
> > sites using Marc
> > > Merlin's SA-Exim patch. I'm running Debian Woody, and thus
> > am using the
> > > version of logcheck that the Debian maintainer has forked.
> >
> > I have logcheck read mainlog, and those are the pattern I wrote
> >
> > Marc
> >
> > --------------------------------------------------------------
> > --------------
> > exim .* daemon started:
> > Failed to create IPv6 socket
> > [0-9] args:
> > Start queue run:
> > End queue run:
> > Address family not supported by protocol
> >
> > # This makes the regex faster while assuming we only
> receive 10 mails
> > a sec -0[0-9] <=
> > -0[0-9] ->.* R=.* T=
> > -0[0-9] =>.* R=.* T=
> > -0[0-9] Completed
> > -0[0-9] .* Connection reset by peer
> > -0[0-9] .*: Connection refused
> > -0[0-9] .*\[[0-9]*\.[0-9]*\.[0-9]*\.[0-9]*\]: No route to host
> >
> > Connection timed out
> > SMTP command timeout on connection from
> > SMTP connection from
> > SMTP error from remote mailer after initial connection
> > SMTP synchronization error
> > SMTP command timeout on TLS connection from
> > SMTP error from remote mailer after end of data
> > SMTP error from remote mailer after RCPT TO
> > SMTP error from remote mailer after MAIL FROM
> > defer .*: host lookup did not complete
> > defer .*: retry time not reached
> > defer .*: No route to host
> > rewritten as.*by rule
> > Sender verify callout did not complete
> > Sender verify did not complete
> > Sender verify failed
> > sender verify fail for
> > sender verify defer for
> > valid RCPT command must precede DATA
> > Could not complete sender callout check
> > retry time not reached for any host
> > unexpected disconnection while reading SMTP command from rejected
> > after DATA rejected EHLO from
> > rejected HELO from
> > # If you want to know about address probes
> > #rejected RCPT.*Unrouteable address
> >
> > 0[0-9] Spool file is locked
> >
> > SA: Debug enabled
> > SA: config read
> > SA: check
> > SA: score
> > SA: fed spam to spamc, reading result
> > SA: Message-Id received and cleaned as
> > SA: spamc read
> > SA: spamc pieced up
> > SA: while reading headers
> > SA: spamc, while parsing header
> > SA: score hits=
> > SA: spamc read got newline, end of headers
> > SA: Read from X-Spam-Status
> > SA: Writing suspected spam/problem message
> > SA: Is Spam read from X-Spam-Flag
> > SA: Body write chunk starts with
> > SA: Processing body chunk
> > SA: local_scan temporarily rejected
> > SA: local_scan permanently rejected
> > SA: local_scan permanently rejected
> > SA: Flagged as Spam but accepted:
> > SA: SAExim.*Cond expand returned
> > SA: savemail condition expand
> > SA: Setting timeout of 240 secs
> > SA: local_scan stall completed. Sending tempreject
> > rejected by local_scan\(\): Heuristics
> > temporarily rejected by local_scan\(\): How about you try
> again later
> > for a little more teergrube?
> > --------------------------------------------------------------
> > --------------
> >
> > --
> > "A mouse is a device used to point at the xterm you want to
> type in" -
> > A.S.R. Microsoft is to operating systems & security ....
> > .... what McDonalds is
> > to gourmet cooking
> > Home page: http://marc.merlins.org/ | Finger
> > marc_f@??? for PGP key
> >
> > --
> >
> > ## List details at
> http://www.exim.org/mailman/listinfo/exim-users Exim details at
> http://www.exim.org/ ##
>
> --
>
> ## List details at
http://www.exim.org/mailman/listinfo/exim-users Exim
details at
http://www.exim.org/ ##
--
## List details at
http://www.exim.org/mailman/listinfo/exim-users Exim
details at
http://www.exim.org/ ##
