I'm running Ubuntu 14.04 LTS server and use logcheck to report log messages.I have the logcheck-database installed which contains a horde3 ignore file for the server:^\w{3} [ :0-9]{11} [._[:alnum:]-]+ .+\[[0-9]+\]: \[horde\] Login success for [@._[:alnum:]-]+ \[[.0-9]{7,15}\] to Horde \[on line [0-9]+ of .+\]$^\w{3} [ :0-9]{11} [._[:alnum:]-]+ .+\[[0-9]+\]: \[horde\] User [@._[:alnum:]-]+ \[[.0-9]{7,15}\] logged out of Horde \[on line [0-9]+ of .+\]$So why is log check reporting the following horde log messages:Feb 20 09:37:13 xxx HORDE: [imp] Login success for xxx@xxx.de (xx.xxx.xxx.xx) to {imap://mail.xxx.de/} [pid 428 on line 157 of /var/www/horde/imp/lib/Auth.php]Feb 20 09:37:37 xxx HORDE: [horde] User xxx@xxx.de logged out of Horde (xx.xx.xxx.xxx) [pid 21839 on line 107 of /var/www/horde/login.php]I'm using Horde Webmail 5.2.5.
Why is logcheck reporting successful Horde logins?
linux;ubuntu;logs;regular expression;syslog