On Sun, 14 Jul 2013, Daniel Black wrote:
>  > +            ^%(_apache_error_client)s user .* authorization failure: \S*\s*$
>  > +            ^%(_apache_error_client)s user .* authorization failure for "\S*": \s*$
>      hm -- we have no sample log lines for these
>    right. better than making it up and its derived from source.

source is great! sample log lines are useful and soon will be mandatory I think ;-)

some places in the source might be unreachable, thus might not even be worth
worrying about.  Sample log lines would provide prove of occurrence in real
cases, and serve as test cases.

>      strange: so the line should end with ": " ?

>    yes I did a double take on that too.
>    [1]http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/aaa/mod_authz_core.c?view=markup#872

indeed strange... google gave me a quick sample confirmation/example

http://www.linuxquestions.org/questions/linux-server-73/apache-2-4-multiple-ldap-servers-4175444618/#post4865280

-- 
Yaroslav O. Halchenko, Ph.D.
http://neuro.debian.net http://www.pymvpa.org http://www.fail2ban.org
Senior Research Associate,     Psychological and Brain Sciences Dept.
Dartmouth College, 419 Moore Hall, Hinman Box 6207, Hanover, NH 03755
Phone: +1 (603) 646-9834                       Fax: +1 (603) 646-1419
WWW:   http://www.linkedin.com/in/yarik