SWAMPy

✎ CARVE FLESH

EDITING: logcheck-sendmail

^(\w{3} [ :0-9]{11}|([0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(\.[0-9]{6})?\+[0-9]{2}:[0-9]{2})) [._[:alnum:]-]+ (sendmail|sm-(mta|msp|que))\[[0-9]+\]: alias database .* rebuilt
^(\w{3} [ :0-9]{11}|([0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(\.[0-9]{6})?\+[0-9]{2}:[0-9]{2})) [._[:alnum:]-]+ (sendmail|sm-(mta|msp|que))\[[0-9]+\]: .*stat=(Refused|Deferred)
^(\w{3} [ :0-9]{11}|([0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(\.[0-9]{6})?\+[0-9]{2}:[0-9]{2})) [._[:alnum:]-]+ (sendmail|sm-(mta|msp|que))\[[0-9]+\]: gethostbyaddr$.*$ failed:
^(\w{3} [ :0-9]{11}|([0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(\.[0-9]{6})?\+[0-9]{2}:[0-9]{2})) [._[:alnum:]-]+ (sendmail|sm-(mta|msp|que))\[[0-9]+\]: rejecting connections on daemon
^(\w{3} [ :0-9]{11}|([0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(\.[0-9]{6})?\+[0-9]{2}:[0-9]{2})) [._[:alnum:]-]+ (sendmail|sm-(mta|msp|que))\[[0-9]+\]: DIGEST-MD5: failed .* later in exchange
^(\w{3} [ :0-9]{11}|([0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(\.[0-9]{6})?\+[0-9]{2}:[0-9]{2})) [._[:alnum:]-]+ (sendmail|sm-(mta|msp|que))\[[0-9]+\]: .*reject=450 4\.7\.1 <[^>]+>... Relaying  temporarily denied. Cannot resolve PTR record for [0-9\.]+$
^(\w{3} [ :0-9]{11}|([0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(\.[0-9]{6})?\+[0-9]{2}:[0-9]{2})) [._[:alnum:]-]+ (sendmail|sm-(mta|msp|que))\[[0-9]+\]: .*reject=451 4\.1\.8 Domain of sender address [^ ]+ does not resolve$
^(\w{3} [ :0-9]{11}|([0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(\.[0-9]{6})?\+[0-9]{2}:[0-9]{2})) [._[:alnum:]-]+ (sendmail|sm-(mta|msp|que))\[[0-9]+\]: .*reject=550 5\.7\.1 (<[^>]+>... )?Access denied$
^(\w{3} [ :0-9]{11}|([0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(\.[0-9]{6})?\+[0-9]{2}:[0-9]{2})) [._[:alnum:]-]+ (sendmail|sm-(mta|msp|que))\[[0-9]+\]: .*reject=550 5\.7\.1 <[^>]+>... Relaying denied. Proper authentication required.$
^(\w{3} [ :0-9]{11}|([0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(\.[0-9]{6})?\+[0-9]{2}:[0-9]{2})) [._[:alnum:]-]+ (sendmail|sm-(mta|msp|que))\[[0-9]+\]: .*reject=550 5\.7\.1 <[^>]+>... Relaying denied. IP name lookup failed \[[0-9\.]+\]$
^(\w{3} [ :0-9]{11}|([0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(\.[0-9]{6})?\+[0-9]{2}:[0-9]{2})) [._[:alnum:]-]+ (sendmail|sm-(mta|msp|que))\[[0-9]+\]: .*reject=550 5\.7\.1 <[^>]+>... Relaying denied. IP name (lookup )?possibly forged \[[0-9\.]+\]$
^(\w{3} [ :0-9]{11}|([0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(\.[0-9]{6})?\+[0-9]{2}:[0-9]{2})) [._[:alnum:]-]+ (sendmail|sm-(mta|msp|que))\[[0-9]+\]: .*reject=553 5\.1\.8 <[^>]+>... Relaying temporarily denied. Cannot resolve PTR record for [0-9\.]+$
^(\w{3} [ :0-9]{11}|([0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(\.[0-9]{6})?\+[0-9]{2}:[0-9]{2})) [._[:alnum:]-]+ (sendmail|sm-(mta|msp|que))\[[0-9]+\]: [[:alnum:]]+: Milter (add|change|delete|message).*:.*$

CANCEL

Name	Type	Size	Modified	Actions
↩ ..	DIR	—	—
📄 logcheck-sendmail	?	2.9 KB	2018-01-13 22:43	EDIT