Homec4science
Diffusion c4science (master) Browse

c4science/roles/logcheck/templates/local-rules
6c2b622cb261master

Last Change
Raw File

local-rules
View Options

^\w{3} [ :0-9]{11} [._[:alnum:]-]+ systemd-logind: New session [[:digit:]]+ of user [._[:alnum:]-]+\.$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ systemd-logind: New user [._[:alnum:]-]+ logged in\.$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ systemd-logind: Removed session [[:digit:]]+\.$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ systemd-logind: User [._[:alnum:]-]+ logged out\.$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd: Expecting device [^[:space:]]+\.device\.\.\.$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd: Failed to read PID from file /run/nginx\.pid: Invalid argument$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd: ((Reached|Stopped) target|((Start|Stopp)ing)) (Basic System|Default|Encrypted Volumes|Graphical Interface|Local File Systems( \(Pre\))?|Login Prompts|Mail Transport Agent|Multi-User System|Network|Network is Online|Paths|Remote File Systems|RPC Port Mapper|Shutdown|Sockets|Sound Card|Swap|System Initialization|Timers)\.$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd: Received SIGRTMIN\+24 from PID [[:digit:]]+ \(kill\)\.$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd: (Reexecuting|Reloading)\.$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd: Reload(ing|ed) LSB: .*\.$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd: (Start(ed|ing)|Stopping) (CUPS Printing Service|Disk Manager|Session [[:digit:]]+ of user [^ ]+)\.*$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd: (Starting|Created|Stopping|Removed)( slice)? (user|system)-[\\[:alnum:]]+\.slice\.$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd: Start(ing|ed) Cleanup of Temporary Directories\.+$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd: Start(ing|ed) ((Daily )?Cleanup of Temporary Directories|Device-mapper event daemon|Hostname Service)\.*$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd: Start(ing|ed) Run anacron jobs\.+$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd: Starting (Shutdown|Exit the Session\.\.|Timers|Default|Basic System|Paths|Sockets)\.$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd: (Starting|Started) Session [[:digit:]]+ of user [^[:space:]]+\.$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd: (Start|Listen)ing (on )?(CUPS Printing Service Sockets|Device-mapper event daemon FIFOs)\.*$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd: ((Start|Stopp)ing) (A high performance web server and a reverse proxy server|Device-mapper event daemon|Exit the Session)\.*$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd: (Start|Stopp)(ing|ed) (Authenticate and Authorize Users to Run Privileged Tasks|Daemon for power management|PackageKit Daemon|RealtimeKit Scheduling Policy Service|User Manager for UID [0-9]+)\.+$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd: (Start|Stopp)(ing|ed) User Manager for UID [0-9]+\.+$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd: Startup finished in [[:digit:]]+ms\.$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd: (Stopping|Stopped target|Reached target) (Shutdown|Timers|Default|Basic System|Paths|Sockets)\.$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd: systemd [[:digit:]]+ running in system mode. \((\+[[:alnum:]]+ ?)+\)$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd: Time has been changed$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd-hostnamed: Warning: nss-myhostname is not installed\. Changing the local hostname might make it unresolveable\. Please install nss-myhostname!$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd-logind: New session [[:digit:]]+ of user [^ ]+\.*$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd-logind: New session [[:digit:]]+ of user [^[:space:]]+\.$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd-logind: Removed session [[:digit:]]+\.$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd: pam_unix\(systemd-user:session\): session (opened|closed) for user [^[:space:]]+( by \(uid=[0-9]+\))?$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ ansible-setup: Invoked with filter=\* fact_path=/etc/ansible/facts\.d$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[[.[:digit:]]+\] SELinux: initialized \(dev tmpfs, type tmpfs\), uses transition SIDs$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: SELinux: initialized \(dev tmpfs, type tmpfs\), uses transition SIDs$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ CROND\[[[:digit:]]+\]: \([._[:alnum:]-]+\) CMD \(.*)$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ run-parts\(/etc/cron\.(daily|hourly|monthly|weekly)\)\[[[:digit:]]+ (starting|finished) [._[:alnum:]-]+$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Received disconnect from [.[:digit:]]+: [[:digit:]]+: \[preauth\]$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Accepted publickey for [._[:alnum:]-]+ from [.[:digit:]]+ port [[:digit:]]+ ssh2: RSA [:[:alnum:]]+$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: fatal: Read from socket failed: Connection reset by peer \[preauth\]$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ anacron\[[[:digit:]]+\]: Anacron started on [-[:digit:]]$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ anacron\[[[:digit:]]+\]: Job `[[:alnum:].-_]+' locked by another anacron - skipping$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ auditd\[[[:digit:]]+\]: Audit daemon rotating log files$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dhclient\[[[:digit:]]+\]: DHCPACK from [.[:digit:]]+ (xid=[[:alnum:]]+\)$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dhclient\[[[:digit:]]+\]: DHCPREQUEST on eth0 to [.[:digit:]]+ port [[:digit:]]+ (xid=[[:alnum:]]+\)$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ rsyslogd: \[origin software="rsyslogd" swVersion="[.[:alnum:]]+" x-pid="[[:digit:]]+" x-info="http://www.rsyslog.com"\] rsyslogd was HUPed$
c4science · Help