[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
LOG test fails to IGNORE ?
- To: hobbit (at) hswn.dk
- Subject: LOG test fails to IGNORE ?
- From: "Jerry Yu" <jjj863 (at) gmail.com>
- Date: Thu, 28 Sep 2006 17:01:40 -0400
- Domainkey-signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:to:subject:mime-version:content-type; b=Sxl1PBJMk6Dr1jiE6JBdf3EH1+dd+Scz1AmTBhQiwI2mCgjq9X6cBjALrIaB1ZIXT89F2vihMc9usGpucGiiKRl44vqmUuDuvi1JN5d8pe2IR0iTB6pySNiPd3lCNRrKsGQT+7hSWzPmE23mCu4PhZqeA/5GRhhCbGLtyDssvnU=
hi,
I have one single Hobbit server running 4.2RC1-20060712 on CentOS 4. Clients
have some harmless SELinux warning messages in /var/log/messages. I
configured Hobbit to ignore such lines (conf entries appended).
However, the LOG test still generates alerts. Below is excerpted from an
email alert. Any idea why? I brought up before 4.2 final version is
released, I believe, and was told it should not be the case.
&yellow Sep 28 15:58:20 saturn su[4070]: Warning! Could not relabel with
user_u:object_r:devpts_t, not relabeling.
---cut---x------ hobbit-clients.cfg -----x-------cut-----
HOST=saturn
log /var/log/messages %WARNING|NOTICE|ERROR COLOR=yellow IGNORE=relabeling
---cut---x------ clients-local.cfg -----x-------cut-----
[saturn]
log:/var/log/messages:10240
ignore MARK