I am using the tool “logcheck” on my Debian servers and created some custom ignore rules to filter out some log entries which I do not want to see in the logcheck reports. However the rules did not work.
Although I double checked the regex syntax several time and also checked it with “grep -E” the rules did not work and the log entries were not filtered out.
After long time debugging I found the reason:
The end-of-line character in my file used the DOS convention (CR/LF) and not the Unix convention (LF) …
After converting my rules file with the command “dos2unix <filename>” everything worked without a problem.
Logcheck: Custom Rules Are Not Working