set mailtime 1m

# Mail command. This may be /bin/mail on some systems.
set mailcmd "/usr/bin/mail -s \"`hostname` `date` log report\" root"

file "/var/log/messages" tag messages
file "/var/log/maillog" tag mail
file "/var/log/secure" tag secure
file "/var/log/authlog" tag auth

match in * "last message repeated [0-9] times" ignore

# newsyslog
match in * "newsyslog\\[[0-9]*\\]: logfile turned over" ignore

# logfmon
match in messages "logfmon: started" ignore

# syslogd
match in messages "syslogd: restart" ignore

# symon
match in messages "symux: rrd_update:.*" ignore
match in messages "symux: rrdupdate -- .*" ignore

match in messages "symux: forked client\\([0-9]*\\) for incoming connection from 10.0.0.2:[0-9]*" ignore
match in messages "symux: client process [0-9]* exited" ignore

# smartd
match in messages "smartd\\[[0-9]*\\]: Device: /dev/wd1c, SMART Usage Attribute: 199 UDMA_CRC_Error_Count changed from [0-9]* to [0-9]*" ignore

# ntpd
match in messages "ntpd\\[[0-9]*\\]: adjusting local clock by [0-9.-]*s" ignore
match in messages "ntpd\\[[0-9]*\\]: peer \\([0-9.]*\\) now valid" ignore
match in messages "ntpd\\[[0-9]*\\]: peer \\([0-9.]*\\) now invalid" ignore
match in messages "ntpd\\[[0-9]*\\]: ntp engine ready" ignore
match in messages "ntpd\\[[0-9]*\\]: clock is now synced" ignore
match in messages "ntpd\\[[0-9]*\\]: clock is now unsynced" ignore

# identd
match in messages "identd\\[[0-9]*\\]: Connection from localhost" ignore
match in messages "identd\\[[0-9]*\\]: request for .* from localhost" ignore
match in messages "identd\\[[0-9]*\\]: Connection from nikita" ignore
match in messages "identd\\[[0-9]*\\]: request for .* from nikita" ignore
match in messages "identd\\[[0-9]*\\]: Successful lookup: [0-9]* , 25 : nicholas" ignore
match in messages "identd\\[[0-9]*\\]: Successful lookup: [0-9]* , 25 : smmsp" ignore
match in messages "identd\\[[0-9]*\\]: Successful lookup: [0-9]* , 25 : root" ignore

# dovecot
match in mail "imap-login: Login: nicholas \\[10.0.0.[0-9]\\]" ignore

# imapd
#match in mail "imapd\\[[0-9]*\\]: Login user=nicholas host=[a-z]*.nicm.ath.cx \\[10.0.[01].[0-9]\\]" ignore
#match in mail "imapd\\[[0-9]*\\]: Preauthenticated user=nicholas host=UNKNOWN" ignore
#match in mail "imapd\\[[0-9]*\\]: Logout user=nicholas host=UNKNOWN" ignore
#match in mail "imapd\\[[0-9]*\\]: imap service init from 10.0.[01].[1-9]" ignore
#match in mail "imapd\\[[0-9]*\\]: Authenticated user=nicholas host=[a-z]*.nicm.ath.cx \\[10.0.[01].[0-9]\\]" ignore
#match in mail "imapd\\[[0-9]*\\]: Killed .lost mailbox lock. user=nicholas host=[a-z]*.nicm.ath.cx \\[10.0.[01].[0-9]\\]" ignore
#match in mail "imapd\\[[0-9]*\\]: Killed .lost mailbox lock. user=nicholas host=UNKNOWN" ignore
#match in mail "imapd\\[[0-9]*\\]: Command stream end of file, while reading line user=nicholas host=[a-z]*.nicm.ath.cx \\[10.0.[01].[0-9]\\]" ignore

# sshd

# sshd context rules
# messages that match contexts fall through to following rules.
#match in auth "sshd\\[\\([0-9]*\\)\\]: Invalid user .* from [0-9.]*" open "sshd-$1" expire 2m
#match in auth "sshd\\[\\([0-9]*\\)\\]: input_userauth_request: invalid user .*" open "sshd-$1" expire 2m pipe "/usr/bin/mail -s \"`date` ssh attempt (expired)\" root"
#match in auth "sshd\\[\\([0-9]*\\)\\]: .*" append "sshd-$1"
#match in auth "sshd\\[\\([0-9]*\\)\\]: Received disconnect from .*" close "sshd-$1" pipe "/usr/bin/mail -s \"`date` ssh attempt\" root"

# normal sshd rules
match in auth "sshd\\[[0-9]*\\]: Connection closed by 10.0.0.[1-9]" ignore
match in auth "sshd\\[[0-9]*\\]: Accepted publickey for root from 10.0.0.[1-9] port [0-9]* ssh2" ignore
match in auth "sshd\\[[0-9]*\\]: Accepted publickey for nicholas from 10.0.0.[1-9] port [0-9]* ssh2" ignore
match in auth "sshd\\[[0-9]*\\]: Root login accepted for forced command." ignore
match in auth "sshd\\[[0-9]*\\]: Postponed publickey for root from 10.0.0.[1-9] port [0-9]* ssh2" ignore

#match in auth "sshd\\[[0-9]*\\]: Invalid user .* from \\([0-9.]*\\)" exec "grep $1 /etc/pf.ignore || (echo $1 >> /etc/pf.ignore; pfctl -t ignore -T add $1; pfctl -k $1)"

#match in auth "sshd\\[[0-9]*\\]: scanned from \\([0-9.]*\\) with SSH-1.0-SSH_Version_Mapper.  Don't panic." exec "grep $1 /etc/pf.ignore || (echo $1 >> /etc/pf.ignore; pfctl -t ignore -T add $1; pfctl -k $1)"

# fetchmail
match in mail "fetchmail\\[[0-9]*\\]: .*" ignore

# sudo
match in secure "sudo:[ \t]*nicholas .*" ignore
match in secure "sudo:[ \t]*root .*" ignore

# rdistd
match in messages "rdistd\\[[0-9]*\\]: [a-z]*: startup for nikita" ignore

# postfix
match in mail "postfix/smtp\\[[0-9]*\\]: [A-Z0-9]*: to=<.*>, relay=smtp.ntlworld.com\\[[0-9.]*\\], delay=[0-9]*, status=sent .*" ignore

match in mail "postfix/smtpd\\[[0-9]*\\]: connect from [a-z]*.nicm.ath.cx\\[10.0.[01].[0-9]\\]" ignore
match in mail "postfix/smtpd\\[[0-9]*\\]: [A-Z0-9]*: client=[a-z]*.nicm.ath.cx\\[10.0.[01].[0-9]\\]" ignore
match in mail "postfix/smtpd\\[[0-9]*\\]: disconnect from [a-z]*.nicm.ath.cx\\[10.0.[01].[0-9]\\]" ignore

match in mail "postfix/smtpd\\[[0-9]*\\]: connect from unknown\\[[0-9.]*\\]" ignore
match in mail "postfix/smtpd\\[[0-9]*\\]: [A-Z0-9]*: client=unknown\\[[0-9.]*\\]" ignore
match in mail "postfix/smtpd\\[[0-9]*\\]: disconnect from unknown\\[[0-9.]*\\]" ignore

match in mail "postfix/smtpd\\[[0-9]*\\]: connect from localhost\\[127.0.0.1\\]" ignore
match in mail "postfix/smtpd\\[[0-9]*\\]: [A-Z0-9]*: client=localhost\\[127.0.0.1\\]" ignore
match in mail "postfix/smtpd\\[[0-9]*\\]: disconnect from localhost\\[127.0.0.1\\]" ignore

match in mail "postfix/smtpd\\[[0-9]*\\]: connect from localhost\\[::1\\]" ignore
match in mail "postfix/smtpd\\[[0-9]*\\]: [A-Z0-9]*: client=localhost\\[::1\\]" ignore
match in mail "postfix/smtpd\\[[0-9]*\\]: disconnect from localhost\\[::1\\]" ignore

match in mail "postfix/pickup\\[[0-9]*\\]: uid=0 from=<root>" ignore
match in mail "postfix/pickup\\[[0-9]*\\]: uid=1000 from=<nicholas>" ignore
match in mail "postfix/pickup\\[[0-9]*\\]: [A-Z0-9]*: uid=0 from=<root>" ignore
match in mail "postfix/pickup\\[[0-9]*\\]: [A-Z0-9]*: uid=1000 from=<nicholas>" ignore

match in mail "postfix/cleanup\\[[0-9]*\\]: .*" ignore

match in mail "postfix/qmgr\\[[0-9]*\\]: [A-Z0-9]*: from=<.*>, size=[0-9]*, nrcpt=1 .*" ignore
match in mail "postfix/qmgr\\[[0-9]*\\]: [A-Z0-9]*: from=<.*>, size=[0-9]*, nrcpt=1 .*" ignore
match in mail "postfix/qmgr\\[[0-9]*\\]: [A-Z0-9]*: removed" ignore

match in mail "postfix/local\\[[0-9]*\\]: [A-Z0-9]*: to=<root@[a-z.]*>, relay=local, delay=[0-9]*, status=sent .*" ignore
match in mail "postfix/local\\[[0-9]*\\]: [A-Z0-9]*: to=<root@[a-z.]*>, orig_to=<root>, relay=local, delay=[0-9]*, status=sent .*" ignore
match in mail "postfix/local\\[[0-9]*\\]: [A-Z0-9]*: to=<nicholas@[a-z.]*>, relay=local, delay=[0-9]*, status=sent .*" ignore
match in mail "postfix/local\\[[0-9]*\\]: [A-Z0-9]*: to=<nicholas@[a-z.]*>, relay=local, delay=[0-9]*, status=sent .*" ignore
match in mail "postfix/local\\[[0-9]*\\]: [A-Z0-9]*: to=<nicholas@[a-z.]*>, orig_to=<nicholas[a-z@.]*>, relay=local, delay=[0-9]*, status=sent .*" ignore
match in mail "postfix/local\\[[0-9]*\\]: [A-Z0-9]*: to=<nicholas@[a-z.]*>, orig_to=<root[a-z@.]*>, relay=local, delay=[0-9]*, status=sent .*" ignore

# sendmail
match in mail "sm-mta\\[[0-9]*\\]: .*" ignore
match in mail "sendmail\\[[0-9]*\\]: [a-zA-Z0-9]*: to=root, ctladdr=.*, delay=00:00:0[0-9], xdelay=00:00:0[0-9], mailer=relay, pri=[0-9]*, relay=.*, dsn=2.0.0, stat=Sent .*" ignore
match in mail "sendmail\\[[0-9]*\\]: [a-zA-Z0-9]*: to=nicholas, ctladdr=.*, delay=00:00:0[0-9], xdelay=00:00:0[0-9], mailer=relay, pri=[0-9]*, relay=.*, dsn=2.0.0, stat=Sent .*" ignore
match in mail "sendmail\\[[0-9]*\\]: [a-zA-Z0-9]*: from=root, size=[0-9]*, class=[0-9], nrcpts=[0-9], msgid=.*, relay=.*" ignore
match in mail "sendmail\\[[0-9]*\\]: [a-zA-Z0-9]*: from=nicholas, size=[0-9]*, class=[0-9], nrcpts=[0-9], msgid=.*, relay=.*" ignore
