Using ignore.conf with logwatch

Question

I have added the following to /etc/postfix/header_checks so that postfix will log the subject lines of every email:

/^subject: /    WARN

This produces log entries in /var/log/mail.log like:

May 19 07:10:48 server postfix/cleanup[1737]: 12E9DB13A3: warning: header Subject: Test Message; from=<www-data@server.domain>

And my logwatch report contains:

Header content warning (but passed): 1 Reason(s), 2030 time(s)

I have put both of the following in my /etc/logwatch/conf/ignore.conf, but they do not seem to avoid this message:

warning: header Subject:
Header content warning (but passed): 1 Reason(s)

Can anyone tell me what I am doing wrong?

Answer 1

The second attempt in /etc/logwatch/conf/ignore.conf is correct, except that the brackets need to be escaped. Adding a backslash before each bracket caused logwatch to correctly ignore the lines.