From 91923b5c072fc6209a9e9aff06f91b7d896ec63f Mon Sep 17 00:00:00 2001 From: sebres Date: Mon, 29 Jul 2019 13:14:04 +0200 Subject: [PATCH] don't need to match identifier exactly (@ is precise enough as prefix), not capturing group; `prefregex` extended, more selective now (denied/NOTAUTH suffix moved from `failregex`, so no catch-all there anymore); update ChangeLog --- ChangeLog | 3 +++ config/filter.d/named-refused.conf | 8 ++++---- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/ChangeLog b/ChangeLog index d152c601..d9f0f171 100644 --- a/ChangeLog +++ b/ChangeLog @@ -71,6 +71,9 @@ ver. 0.10.5-dev-1 (20??/??/??) - development edition - extended with new postfix filter mode `errors` to match "too many errors" (gh-2439), also included within modes `normal`, `more` (`extra` and `aggressive`), since postfix parameter `smtpd_hard_error_limit` is default 20 (additionally consider `maxretry`) +* `filter.d/named-refused.conf`: + - support BIND 9.11.0 log format (includes an additional field @0xXXX..., gh-2406); + - `prefregex` extended, more selective now (denied/NOTAUTH suffix moved from failregex, so no catch-all there anymore) ### New Features * new failregex-flag tag `` for failregex, signaled that the access to service was gained diff --git a/config/filter.d/named-refused.conf b/config/filter.d/named-refused.conf index 989dedb4..0d5a6275 100644 --- a/config/filter.d/named-refused.conf +++ b/config/filter.d/named-refused.conf @@ -34,11 +34,11 @@ __daemon_combs_re=(?:%(__pid_re)s?:\s+%(__daemon_re)s|%(__daemon_re)s%(__pid_re) # this can be optional (for instance if we match named native log files) __line_prefix=(?:\s\S+ %(__daemon_combs_re)s\s+)? -prefregex = ^%(__line_prefix)s( error:)?\s*client( @[0-9a-z]+)? #\S+( \([\S.]+\))?: .+$ +prefregex = ^%(__line_prefix)s(?: error:)?\s*client(?: @\S*)? #\S+(?: \([\S.]+\))?: .+\s(?:denied|\(NOTAUTH\))\s*$ -failregex = ^(view (internal|external): )?query(?: \(cache\))? '.*' denied\s*$ - ^zone transfer '\S+/AXFR/\w+' denied\s*$ - ^bad zone transfer request: '\S+/IN': non-authoritative zone \(NOTAUTH\)\s*$ +failregex = ^(?:view (?:internal|external): )?query(?: \(cache\))? + ^zone transfer + ^bad zone transfer request: '\S+/IN': non-authoritative zone ignoreregex =