Fwd: postfix - "read from"/"write to" regex should be caseinsensitive

---------- Forwarded message ----------
From: Joerg Hohwieler <[email protected]>
Date: Dec 29, 2007 3:52 AM
Subject: postfix - "read from"/"write to" regex should be caseinsensitive
To: [email protected]


hi,

I've always seen these annoying messages in my daily logwatch mails:

1   Dec 28 18:32:29 hohwie postfix/smtpd[5165]: write to 006AFE00
[006AD2B0] (2054 bytes => 2054 (0x806))
1   Dec 28 12:13:18 hohwie postfix/smtpd[15888]: read from 006A99B0
[006B4390] (11 bytes => -1 (0xFFFFFFFFFFFFFFFF))
1   Dec 28 20:45:45 hohwie postfix/smtpd[10678]: read from 006ABCF0
[006B54D5] (1 bytes => -1 (0xFFFFFFFFFFFFFFFF))
1   Dec 28 17:59:50 hohwie postfix/smtpd[3025]: read from 006ABCF0
[006B54D5] (134 bytes => 134 (0x86))
1   Dec 28 18:22:04 hohwie postfix/smtpd[4883]: write to 006AB3A0
[006C0CA0] (2054 bytes => 2054 (0x806))
1   Dec 28 18:32:30 hohwie postfix/smtpd[5165]: read from 006AFE00
[006B8495] (48 bytes => -1 (0xFFFFFFFFFFFFFFFF))
1   Dec 28 20:22:42 hohwie postfix/smtpd[9630]: read from 006B25B0
[006BB0C0] (11 bytes => 11 (0xB))
1   Dec 28 20:08:43 hohwie postfix/smtpd[9199]: read from 006ABCF0
[006B54D0] (11 bytes => 11 (0xB))
1   Dec 28 19:30:34 hohwie postfix/smtpd[7658]: read from 006ABCF0
[006B54D5] (134 bytes => -1 (0xFFFFFFFFFFFFFFFF))

So I got a closer look to /usr/share/logwatch/scripts/services/postfix:

--snip
# more from mail.info level and above
or ( $p1 =~ m/^read from [a-f\d]{8}/ )
or ( $p1 =~ m/^write to [a-f\d]{8}/ )
--snap

Unfortunately these regexs don't match for me because of the
uppercase letters in 006ABCF0.

Therefore I changed the regex to be caseinsensitive.
Here comes my patch:

--- logwatch/scripts/services/postfix.orig      2007-12-29
11:29:12.000000000 +0100
+++ logwatch/scripts/services/postfix   2007-12-29 11:29:24.000000000 +0100
@@ -686,8 +686,8 @@ while ( <> ) {
       or ( $p1 =~ /^[a-f\d]{4} [a-f\d]{2}/ )
       or ( $p1 =~ /^[a-f\d]{4} - <SPACES/ )
       # more from mail.info level and above
-      or ( $p1 =~ m/^read from [a-f\d]{8}/ )
-      or ( $p1 =~ m/^write to [a-f\d]{8}/ )
+      or ( $p1 =~ m/^read from [a-f\d]{8}/i )
+      or ( $p1 =~ m/^write to [a-f\d]{8}/i )

    );


        joerg




-- 
Kirk Bauer <[email protected]>
http://linux.kaybee.org | www.logwatch.org
Author, Automating UNIX & Linux Administration