179 lines
4.2 KiB
CFEngine3
179 lines
4.2 KiB
CFEngine3
##
|
|
# NOTE:
|
|
# Editing this file is not recommended. If you do, you might miss newer
|
|
# revisions of this list in the future versions.
|
|
# See weed_local.cf for instructions on how to add or delete rules.
|
|
#
|
|
|
|
[pam]
|
|
\(pam_unix\).*: session closed for
|
|
\(pam_unix\).*: check pass;
|
|
|
|
[dhcpd]
|
|
dhcpd: DHCPREQUEST
|
|
dhcpd: DHCPACK
|
|
dhcpd: DHCPDISCOVER
|
|
dhcpd: DHCPOFFER
|
|
dhcpd: DHCPRELEASE
|
|
dhcpd: DHCPINFORM
|
|
|
|
[rpc]
|
|
rpc.mountd: authenticated mount request from
|
|
rpc.mountd: authenticated unmount request
|
|
rpc.statd.*: Version .* Starting
|
|
rpc.statd.*: Caught signal 15, un-registering and exiting
|
|
|
|
[automount]
|
|
automount.*: expired
|
|
automount.*: attempting to mount entry
|
|
automount.*: lookup\(file\): .* failed
|
|
automount.*: starting automounter
|
|
automount.*: using kernel protocol
|
|
automount.*: shutting down
|
|
automount.*: .* No such key in map
|
|
|
|
[crond]
|
|
CROND.*: \(mailman\) CMD \(/usr/bin/python
|
|
CROND.*: \(root\) CMD \(.*/sbin/rmmod -as\)
|
|
CROND.*: \(root\) CMD \(/usr/lib/sa/sa\d
|
|
CROND.*: \(root\) CMD \(run-parts
|
|
anacron.*: Updated timestamp for job
|
|
|
|
[bind]
|
|
named.*: lame server resolving
|
|
named.*: .* NS points to CNAME
|
|
named.*: Response from unexpected source
|
|
named.*: .* All possible A RR's lame
|
|
named.*: bad referral
|
|
named.*: Cleaned cache
|
|
named.*: USAGE
|
|
named.*: NSTATS
|
|
named.*: XSTATS
|
|
named.*: .* points to a CNAME
|
|
named.*: denied update from
|
|
named.*: .* Bogus LOOPBACK
|
|
|
|
[gnome]
|
|
gnome-name-server.*: input condition is:
|
|
gnome-name-server.*: name server starting
|
|
gnome-name-server.*: starting
|
|
gnome-name-server.*: name server was running
|
|
gconfd.*: Resolved address
|
|
gconfd.*: GConf server is not in use
|
|
gconfd.*: Exiting
|
|
gconfd.*: starting
|
|
gconfd.*: .* shutting down cleanly
|
|
gdm.*: Couldn't authenticate user
|
|
xscreensaver.*: FAILED LOGIN
|
|
|
|
[sshd]
|
|
sshd.*: Generating new .* key.
|
|
sshd.*: .* key generation complete
|
|
sshd.*: Connection closed
|
|
sshd.*: Could not reverse map address
|
|
sshd.*: Received disconnect from
|
|
sshd.*: error: Could not get shadow information for
|
|
sshd.*: Invalid user .* from
|
|
|
|
[xinetd]
|
|
xinetd.*: .* Transport endpoint is not connected
|
|
xinetd.*: EXIT:
|
|
|
|
[uw-imap]
|
|
imapd.*: AUTHENTICATE
|
|
imapd.*: Logout
|
|
imapd.*: Killed
|
|
imapd.*: imap.*service init
|
|
imapd.*: Command stream end of file
|
|
imapd.*: Autologout
|
|
imapd.*: Connection reset by peer
|
|
ipop3d.*: AUTHENTICATE
|
|
ipop3d.*: Logout
|
|
ipop3d.*: Killed
|
|
ipop3d.*: Autologout
|
|
ipop3d.*: pop3.*service init
|
|
|
|
[courier-imap]
|
|
imapd.*: Connection, ip=\[\S+\]
|
|
imapd.*: LOGOUT, user=\S+, ip=\[\S+\]
|
|
imapd.*: Disconnected, ip=\[\S+\]
|
|
imapd.*: DISCONNECTED, user=\S+, ip=\[\S+\]
|
|
imapd.*: LOGOUT, ip=\[\S+\]
|
|
pop3d.*: Connection, ip=\[\S+\]
|
|
pop3d.*: LOGOUT, user=\S+, ip=\[\S+\]
|
|
pop3d.*: Disconnected, ip=\[\S+\]
|
|
pop3d.*: DISCONNECTED, user=\S+, ip=\[\S+\]
|
|
pop3d.*: LOGOUT, ip=\[\S+\]
|
|
|
|
[postfix]
|
|
postfix/smtp\[\d+\]: connect to
|
|
postfix/smtp\[\d+\]: warning: no MX host
|
|
postfix/smtp\[\d+\]: warning: numeric domain name in resource data
|
|
postfix/smtp\[\d+\]: warning: host .* with my own hostname
|
|
postfix/smtpd.*: connect from
|
|
postfix/smtpd.*: disconnect from
|
|
postfix/smtpd.*: TLS connection established
|
|
postfix/smtpd.*: lost connection
|
|
postfix/cleanup
|
|
postfix/pickup
|
|
|
|
[sendmail]
|
|
sendmail\[.*:.*NOQUEUE: Null connection from
|
|
sendmail\[.*:.*timeout waiting for input
|
|
|
|
[qmail]
|
|
qmail:.* new msg
|
|
qmail:.* end msg
|
|
qmail:.* status:
|
|
|
|
[spamd]
|
|
spamd\[.*: info:
|
|
spamd\[.*: processing message
|
|
spamd\[.*: checking message
|
|
spamd\[.*: connection from
|
|
spamd\[.*: Creating default_prefs
|
|
|
|
[printer]
|
|
printer: ready to print
|
|
printer: status change
|
|
printer: printing
|
|
printer: peripheral low-power state
|
|
|
|
[pumpd]
|
|
pumpd.*: renewed lease for interface
|
|
pumpd.*: configured interface
|
|
|
|
[afpd]
|
|
afpd.*: ASIP session:
|
|
afpd.*: afp_flushfork:
|
|
afpd.*: .*B read,.*B written
|
|
|
|
[ntpd]
|
|
ntpd.*: kernel time discipline status change
|
|
|
|
[kernel]
|
|
kernel: application .* uses obsolete OSS audio interface
|
|
kernel: SELinux: initialized
|
|
kernel: device .* left promiscuous mode
|
|
kernel: .*: disabled promiscuous mode
|
|
usb-uhci.c: interrupt, status
|
|
PCI: Found IRQ
|
|
PCI: Sharing IRQ
|
|
PCI: Setting latency timer
|
|
kernel: agpgart: Found
|
|
kernel: agpgart: Putting
|
|
|
|
[misc]
|
|
modprobe: Can't locate module
|
|
logger: punching nameserver .* through the firewall
|
|
HORDE\[\S*\s*\[imp\] Logout
|
|
LOGIN ON tty.
|
|
dhclient: DHCPREQUEST
|
|
dhclient: DHCPACK
|
|
dhclient: DHCPDISCOVER
|
|
dhclient: bound to
|
|
dbus: avc: .* buckets used
|
|
|
|
|
|
|
|
## $Revision: 1.14.2.4 $ ##
|