update rules

diff --git a/files/etc/logcheck/ignore.d.server/local-dovecot b/files/etc/logcheck/ignore.d.server/local-dovecot
index f2c78e713c6ee685efb167bc55dda28969b2ca55..804b6a18d1db94bcf612cc860d87d4179fd116f7 100644 (file)
--- a/files/etc/logcheck/ignore.d.server/local-dovecot
+++ b/files/etc/logcheck/ignore.d.server/local-dovecot
@@ -68,6 +68,7 @@
 ^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: Disconnected: Connection closed: SSL_accept\(\) failed: error:0A0000C1:SSL routines::no shared cipher \(no auth attempts in [[:digit:]]+ secs\): user=<>, rip=[[:xdigit:]:.]+, lip=[[:xdigit:]:.]+, TLS handshaking: SSL_accept\(\) failed: error:0A0000C1:SSL routines::no shared cipher, session=<[[:alnum:]/+]+>$
 ^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: Disconnected: Connection closed: SSL_accept\(\) failed: error:0A000102:SSL routines::unsupported protocol \(no auth attempts in [[:digit:]]+ secs\): user=<>, rip=[[:xdigit:]:.]+, lip=[[:xdigit:]:.]+, TLS handshaking: SSL_accept\(\) failed: error:0A000102:SSL routines::unsupported protocol, session=<[[:alnum:]/+]+>$
 ^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: Disconnected: Connection closed: SSL_accept\(\) failed: error:0A00010B:SSL routines::wrong version number \(no auth attempts in [[:digit:]]+ secs\): user=<>, rip=[[:xdigit:]:.]+, lip=[[:xdigit:]:.]+, TLS handshaking: SSL_accept\(\) failed: error:0A00010B:SSL routines::wrong version number, session=<[[:alnum:]/+]+>$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: Disconnected: Connection closed: SSL_accept\(\) failed: error:0A00018C:SSL routines::version too low \(no auth attempts in [[:digit:]]+ secs\): user=<>, rip=[[:xdigit:]:.]+, lip=[[:xdigit:]:.]+, TLS handshaking: SSL_accept\(\) failed: error:0A00018C:SSL routines::version too low, session=<[[:alnum:]/+]+>$
 ^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: Disconnected(: Inactivity during authentication)? \(client didn't finish SASL auth, waited [[:digit:]]+ secs\): user=<[^>]*>, method=PLAIN, rip=[[:xdigit:]:.]+, lip=[[:xdigit:]:.]+, TLS( handshaking)?: (Connection closed|Disconnected|SSL_read\(\) syscall failed: Connection reset by peer), session=<[[:alnum:]/+]+>$
 ^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: Disconnected(: Inactivity during authentication)? \(client didn't finish SASL auth, waited [[:digit:]]+ secs\): user=<[^>]*>, method=PLAIN, rip=[[:xdigit:]:.]+, lip=[[:xdigit:]:.]+, TLS, session=<[[:alnum:]/+]+>$
 ^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: Disconnected (tried to use unsupported auth mechanism): user=<[-_.@[:alnum:]]*>, method=[[:alnum:]-]+, rip=[[:xdigit:]:.]+, lip=[[:xdigit:]:.]+, mpid=[[:digit:]]+,)? (TLS( handshake)?|secured))?(: Disconnected)?(, session=<[[:alnum:]/+]+>)?$