# dla partycji UFS
#
setfacl -m u:logcheck:rwx /var/log
setfacl -m g:logcheck:r /var/log/security /var/log/auth.log

# dla partycji ZFS
#
setfacl -m u:logcheck:rwx::allow /var/log
setfacl -m g:logcheck:r::allow /var/log/security /var/log/auth.log

chgrp -R logcheck /var/log/sudo/
chown -R logcheck /usr/local/share/logcheck/detectrotate/

--- kernel.orig 2014-12-08 12:24:33.312207000 +0100
+++ kernel      2014-12-09 11:12:54.385550315 +0100
@@ -1,2 +1,2 @@
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel:( \[ *[[:digit:]]+\.[[:digit:]]+\])? [[:alnum:]]+: media error \(bad sector\): status=0x[[:xdigit:]]+ { DriveReady SeekComplete Error }$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel:( \[ *[[:digit:]]+\.[[:digit:]]+\])? [[:alnum:]]+: media error \(bad sector\): status=0x[[:xdigit:]]+ \{ DriveReady SeekComplete Error \}$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel:( \[ *[[:digit:]]+\.[[:digit:]]+\])? end_request: I/O error, dev [[:alnum:]]+, sector [[:digit:]]+

--- cyrus.orig  2014-03-18 00:18:27.000000000 +0100
+++ cyrus       2014-07-30 00:47:50.000000000 +0200
@@ -4,3 +4,12 @@
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ cyrus/lmtpd\[[0-9]+\]: DBERROR db3: [12] lockers$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ cyrus/notifyd\[[0-9]+\]: MAIL, , [^[:space:]]+, [^[:space:]]+,  \"[ [:alnum:][:punct:]]+\"$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ cyrus/squatter\[[0-9]+\]: (skipping|indexing) mailbox [[:alpha:]^\.]+\.\.\.$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ctl_cyrusdb\[[0-9]+\]: (done )?checkpointing cyrus databases
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pop3s?\[[0-9]+\]: counts: retr
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pop3s?\[[0-9]+\]: starttls: TLSv1 with cipher
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pop3s?\[[0-9]+\]: imapd:Loading hard-coded DH parameters
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ (pop3s?|lmtpunix|imap)\[[0-9]+\]: USAGE [^[:space:]]+ user:
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pop3s?\[[0-9]+\]: Expunged [0-9]+ messages from user
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ (pop3s?|imap)\[[0-9]+\]: .* User logged in SESSIONID=
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sieve\[[0-9]+\]: .* User logged in
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ (pop3s?|imap)\[[0-9]+\]: .* starttls: