isc-dhcp 4.2.4-5's DHCPREQUEST messages no longer match ignore regex

Bug #1134592 reported by Blair Zajac
12
This bug affects 2 people
Affects Status Importance Assigned to Milestone
logcheck (Ubuntu)
Confirmed
Undecided
Unassigned

Bug Description

After upgrading my raring VMs to the latest isc-dhcp:

    isc-dhcp (4.2.4-5ubuntu1) raring; urgency=low
    isc-dhcp (4.2.4-5) unstable; urgency=medium

logcheck's email now includes DHCPREQUEST messages. This is very annoying when deployed in a OpenStack since the client does a DHCP request every minute or so ;)

Here are some messages that are correctly filtered out:

$ zcat syslog.7.gz |grep DHCPRE | head -4
Feb 20 06:39:37 server-43cadf07-0162-4924-a329-f522bd6f0490 dhclient: DHCPREQUEST of 192.168.2.2 on eth0 to 192.168.2.1 port 67
Feb 20 06:40:30 server-43cadf07-0162-4924-a329-f522bd6f0490 dhclient: DHCPREQUEST of 192.168.2.2 on eth0 to 192.168.2.1 port 67
Feb 20 06:41:23 server-43cadf07-0162-4924-a329-f522bd6f0490 dhclient: DHCPREQUEST of 192.168.2.2 on eth0 to 192.168.2.1 port 67
Feb 20 06:42:15 server-43cadf07-0162-4924-a329-f522bd6f0490 dhclient: DHCPREQUEST of 192.168.2.2 on eth0 to 192.168.2.1 port 67

And here are messages now appearing in the email:

This email is sent by logcheck. If you no longer wish to receive
such mail, you can either deinstall the logcheck package or modify
its configuration file (/etc/logcheck/logcheck.conf).

System Events
=-=-=-=-=-=-=
Feb 27 08:02:48 server-43cadf07-0162-4924-a329-f522bd6f0490 dhclient: DHCPREQUEST of 192.168.2.2 on eth0 to 192.168.2.1 port 67 (xid=0x593f7ff6)
Feb 27 08:03:36 server-43cadf07-0162-4924-a329-f522bd6f0490 dhclient: DHCPREQUEST of 192.168.2.2 on eth0 to 192.168.2.1 port 67 (xid=0x593f7ff6)
Feb 27 08:04:28 server-43cadf07-0162-4924-a329-f522bd6f0490 dhclient: DHCPREQUEST of 192.168.2.2 on eth0 to 192.168.2.1 port 67 (xid=0x593f7ff6)
Feb 27 08:05:14 server-43cadf07-0162-4924-a329-f522bd6f0490 dhclient: DHCPREQUEST of 192.168.2.2 on eth0 to 192.168.2.1 port 67 (xid=0x593f7ff6)

It looks like the xid text is not matched.

ProblemType: Bug
DistroRelease: Ubuntu 13.04
Package: logcheck-database 1.3.15
ProcVersionSignature: Ubuntu 3.8.0-7.15-generic 3.8.0
Uname: Linux 3.8.0-7-generic x86_64
ApportVersion: 2.8-0ubuntu4
Architecture: amd64
Date: Wed Feb 27 09:21:51 2013
Dependencies:

Ec2AMI: ami-0000000e
Ec2AMIManifest: FIXME
Ec2AvailabilityZone: nova
Ec2InstanceType: ec2-m1.small
Ec2Kernel: unavailable
Ec2Ramdisk: unavailable
MarkForUpload: True
PackageArchitecture: all
ProcEnviron:
 SHELL=/bin/bash
 TERM=xterm
 PATH=(custom, no user)
 LANG=en_US.UTF-8
SourcePackage: logcheck
UpgradeStatus: No upgrade log present (probably fresh install)

Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in logcheck (Ubuntu):
status: New → Confirmed
Revision history for this message
frankster (wtfrank) wrote :

I've been experiencing this irritation for the last year and a half and I've finally diagnosed it.

The problem seems to be that the log line emitted by dhclient has changed since the logcheck pattern was written. A sample log line is:

Oct 11 07:22:55 mythtv dhclient: DHCPREQUEST of 192.168.1.2 on eth0 to 192.168.1.1 port 67 (xid=0x2e36de11)

The current pattern in /etc/logcheck/ignore.d.server/dhclient is:

^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhclient(-2.2.x)?: DHCP(REQUEST|RELEASE) (of [.0-9]{7,15} )?on [[:alnum:].-]+ to [.0-9]{7,15} port 67$

This doesn't match the final xid section of the log line, so the line should be updated to something like the following:

^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dhclient(-2.2.x)?: DHCP(REQUEST|RELEASE) (of [.0-9]{7,15} )?on [[:alnum:].-]+ to [.0-9]{7,15} port 67 (\(xid=0x[[:alnum:]]+\))?$

Revision history for this message
frankster (wtfrank) wrote :

# cat /etc/issue.net
Ubuntu 14.04.3 LTS

Robie Basak (racb)
tags: added: needs-upstream-report
Revision history for this message
Nish Aravamudan (nacc) wrote :

This was fixed upstream/Debian/Ubuntu via Bug #1357880 -- so I'm duping this over there and adding tasks there for SRU'ing the fix back.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.