[Logcheck-devel] Bug#301175: logcheck-databas: SSH rules for debug level

[maximilian attems]

On Thu, 24 Mar 2005, Todd Troxell wrote:

> Hi Jari,
> 
> On Thu, Mar 24, 2005 at 10:17:39AM +0200, Jari Aalto wrote:
> > If it were possible, please add rules to ignore SSH debug level messages
> > like these:
> > 
> >   Mar 22 18:59:29 cante sshd[5673]: debug2: channel 4: rcvd adjust 66020
> >   Mar 22 18:59:34 cante sshd[5673]: debug2: channel 4: window 32736 sent adjust 32800
> > 
> > Sometimes the SSH need to be run with DEBUG in order to pinpoint
> > connection troubles and the logcheck messages tend to be rather long
> > if these messages are included.
> 
> I think we probably don't want to have debug filters in place by default, but
> this has given me an idea.
> 
> We get a lot of requests for start/stop messages and debug messages.  I'm not
> really up for supporting debug messages, but if people want to write patches,
> I will include a new "optional" rule directory (perhaps there is a better
> name for this) that will be disabled by default, but allow for submission of
> start/stop messages and debug messages.
> 
> Sound good?

ok *fun*, would also be able to add another layer of confusion
for our users.

/me prefers kiss.

i would just close such requests with the remark that local-foo rules,
are very easily added for such generic cases,
but that they are not acceptable upstream.

we already ship that many rule that on my lame p1 print server at
university the logcheck runs are quite "felt" when logged in.

but perhaps your optional makes everyone happy. :-)

was away for easter will see if i have any small things pending.
a++ maks