Re: Fwd: postfix - "read from"/"write to" regex should be caseinsensitive

Kirk Bauer wrote:
> ---------- Forwarded message ----------
> From: Joerg Hohwieler
> Subject: postfix - "read from"/"write to" regex should be caseinsensitive
>
> hi,
>
> I've always seen these annoying messages in my daily logwatch mails:
>
> 1   Dec 28 18:32:29 hohwie postfix/smtpd[5165]: write to 006AFE00
> [006AD2B0] (2054 bytes => 2054 (0x806))
> 1   Dec 28 12:13:18 hohwie postfix/smtpd[15888]: read from 006A99B0
> [006B4390] (11 bytes => -1 (0xFFFFFFFFFFFFFFFF))
> 1   Dec 28 20:45:45 hohwie postfix/smtpd[10678]: read from 006ABCF0
> [006B54D5] (1 bytes => -1 (0xFFFFFFFFFFFFFFFF))
> 1   Dec 28 17:59:50 hohwie postfix/smtpd[3025]: read from 006ABCF0
> [006B54D5] (134 bytes => 134 (0x86))
> 1   Dec 28 18:22:04 hohwie postfix/smtpd[4883]: write to 006AB3A0
> [006C0CA0] (2054 bytes => 2054 (0x806))
> 1   Dec 28 18:32:30 hohwie postfix/smtpd[5165]: read from 006AFE00
> [006B8495] (48 bytes => -1 (0xFFFFFFFFFFFFFFFF))
> 1   Dec 28 20:22:42 hohwie postfix/smtpd[9630]: read from 006B25B0
> [006BB0C0] (11 bytes => 11 (0xB))
> 1   Dec 28 20:08:43 hohwie postfix/smtpd[9199]: read from 006ABCF0
> [006B54D0] (11 bytes => 11 (0xB))
> 1   Dec 28 19:30:34 hohwie postfix/smtpd[7658]: read from 006ABCF0
> [006B54D5] (134 bytes => -1 (0xFFFFFFFFFFFFFFFF))
>
> So I got a closer look to /usr/share/logwatch/scripts/services/postfix:
>
> --snip
> # more from mail.info level and above
> or ( $p1 =~ m/^read from [a-f\d]{8}/ )
> or ( $p1 =~ m/^write to [a-f\d]{8}/ )
> --snap
>
> Unfortunately these regexs don't match for me because of the
> uppercase letters in 006ABCF0.
>
> Therefore I changed the regex to be caseinsensitive.
> Here comes my patch:
>
> --- logwatch/scripts/services/postfix.orig      2007-12-29
> 11:29:12.000000000 +0100
> +++ logwatch/scripts/services/postfix   2007-12-29 11:29:24.000000000 +0100
> @@ -686,8 +686,8 @@ while ( <> ) {
>        or ( $p1 =~ /^[a-f\d]{4} [a-f\d]{2}/ )
>        or ( $p1 =~ /^[a-f\d]{4} - <SPACES/ )
>        # more from mail.info level and above
> -      or ( $p1 =~ m/^read from [a-f\d]{8}/ )
> -      or ( $p1 =~ m/^write to [a-f\d]{8}/ )
> +      or ( $p1 =~ m/^read from [a-f\d]{8}/i )
> +      or ( $p1 =~ m/^write to [a-f\d]{8}/i )
>
>     );
>
>
>         joerg
>   
Joerg,

Thanks for the report and patch.  This issue was resolved some time 
ago.  Please update as you see fit:

http://www.mikecappella.com/logwatch

MrC