diff options
author | Hendrik Jäger <hendrik@securosys.ch> | 2019-01-10 08:22:30 +0100 |
---|---|---|
committer | Hendrik Jäger <hendrik@securosys.ch> | 2019-01-10 08:22:30 +0100 |
commit | 481e3a0f0266b191ffba8b466d03263b42bd2c72 (patch) | |
tree | be1e81fabba177e9b27bd343ec9835ab8148bf7f /files | |
parent | 3a0721ee5734ff96aa862d2fee5887693f313ee9 (diff) |
Update logcheck rules for wpasupplicant: fix regex
Diffstat (limited to 'files')
-rw-r--r-- | files/etc/logcheck/ignore.d.server/local-wpasupplicant | 2 | ||||
-rw-r--r-- | files/etc/logcheck/ignore.d.workstation/local-wpasupplicant | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/files/etc/logcheck/ignore.d.server/local-wpasupplicant b/files/etc/logcheck/ignore.d.server/local-wpasupplicant index c994656..72ec854 100644 --- a/files/etc/logcheck/ignore.d.server/local-wpasupplicant +++ b/files/etc/logcheck/ignore.d.server/local-wpasupplicant @@ -17,7 +17,7 @@ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: ((wlan[0-9]|wlp[0-9]s[0-9]): )?CTRL-EVENT-CONNECTED - Connection to ([0-9a-f]{2}:){5}[0-9a-f]{2} completed (\((re)?auth\) )?\[id=[0-9]+ id_str=[_[:alnum:]]*\]$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: ((wlan[0-9]|wlp[0-9]s[0-9]): )?CTRL-EVENT-EAP-PEER-CERT depth=0 subject='/CN=[^']*' hash=[[:xdigit:]]+$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: ((wlan[0-9]|wlp[0-9]s[0-9]): )?CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=[[:digit:]]+$ -^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: ((wlan[0-9]|wlp[0-9]s[0-9]): )?CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=[[:digit:]]+ -\> NAK$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: ((wlan[0-9]|wlp[0-9]s[0-9]): )?CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=[[:digit:]]+ -> NAK$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: ((wlan[0-9]|wlp[0-9]s[0-9]): )?CTRL-EVENT-EAP-(STARTED EAP authentication started|SUCCESS EAP authentication completed successfully|METHOD EAP vendor 0 method (17 \(LEAP|25 \(PEAP)\) selected)$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: ((wlan[0-9]|wlp[0-9]s[0-9]): )?CTRL-EVENT-SUBNET-STATUS-UPDATE status=0$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: ((wlan[0-9]|wlp[0-9]s[0-9]): )?(SME: )?Trying to (authenticate|associate) with ([0-9a-f]{2}:){5}[0-9a-f]{2} \(SSID='[.[:alnum:]-]+' freq=(24([1-6][27]|72|84)|5(2[046]|3[02]|5[068]|6[68]|70)0) MHz\)$ diff --git a/files/etc/logcheck/ignore.d.workstation/local-wpasupplicant b/files/etc/logcheck/ignore.d.workstation/local-wpasupplicant index 62d714e..ac89ec0 100644 --- a/files/etc/logcheck/ignore.d.workstation/local-wpasupplicant +++ b/files/etc/logcheck/ignore.d.workstation/local-wpasupplicant @@ -17,7 +17,7 @@ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: ((wlan[0-9]|wlp[0-9]s[0-9]): )?Associated with ([0-9a-f]{2}:){5}[0-9a-f]{2}$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: ((wlan[0-9]|wlp[0-9]s[0-9]): )?CTRL-EVENT-CONNECTED - Connection to ([0-9a-f]{2}:){5}[0-9a-f]{2} completed (\((re)?auth\) )?\[id=[0-9]+ id_str=[_[:alnum:]]*\]$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: ((wlan[0-9]|wlp[0-9]s[0-9]): )?CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=[[:digit:]]+$ -^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: ((wlan[0-9]|wlp[0-9]s[0-9]): )?CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=[[:digit:]]+ -\> NAK$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: ((wlan[0-9]|wlp[0-9]s[0-9]): )?CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=[[:digit:]]+ -> NAK$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: ((wlan[0-9]|wlp[0-9]s[0-9]): )?CTRL-EVENT-SUBNET-STATUS-UPDATE status=0$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: ((wlan[0-9]|wlp[0-9]s[0-9]): )?(SME: )?Trying to (authenticate|associate) with ([0-9a-f]{2}:){5}[0-9a-f]{2} \(SSID='[.[:alnum:]-]+' freq=(24([1-6][27]|72|84)|5(2[046]|3[02]|5[068]|6[68]|70)0) MHz\)$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: ((wlan[0-9]|wlp[0-9]s[0-9]): )?WPA: Group rekeying completed with ([0-9a-f]{2}:){5}[0-9a-f]{2} \[GTK=(CCMP|TKIP)\]$ |