2

I have added the following to /etc/postfix/header_checks so that postfix will log the subject lines of every email:

/^subject: /    WARN

This produces log entries in /var/log/mail.log like:

May 19 07:10:48 server postfix/cleanup[1737]: 12E9DB13A3: warning: header Subject: Test Message; from=<www-data@server.domain>

And my logwatch report contains:

Header content warning (but passed): 1 Reason(s), 2030 time(s)

I have put both of the following in my /etc/logwatch/conf/ignore.conf, but they do not seem to avoid this message:

warning: header Subject:
Header content warning (but passed): 1 Reason(s)

Can anyone tell me what I am doing wrong?

Brent
  • 22,857
  • 19
  • 70
  • 102

2 Answers2

3

Just for the records: logwatch uses Perl style regexes in ignore.conf. So look at 

$ man 1 perlre
DirkR
  • 131
  • 1
3

The second attempt in /etc/logwatch/conf/ignore.conf is correct, except that the brackets need to be escaped. Adding a backslash before each bracket caused logwatch to correctly ignore the lines.

Brent
  • 22,857
  • 19
  • 70
  • 102