I am using logwatch to monitor our log files but we also use a third party service to test the site for vulnerabilities (McAfee Secure). This means that the logwatch email is full of results from the McAfee probe which is making it difficult to see anything else in the report.
I had thought that I could use $HTTP_IGNORE_IPS to exclude these IPs but this seems to have no effect.
This is what I have put in the conf file:
$HTTP_IGNORE_IPS = ^161\.69\.158\.|^161\.69\.170\.|^161\.69\.14\.|^161\.69\.30\.|^161\.69\.227\.|^161\.69\.162\.|^62\.|^161\.69\.46\.|^125\.7\.88\.|^161\.69\.197\.
Does that look correct or is this parameter for something else? If so how can I exclude these IPs?