[Logcheck-devel] Bug#301175: logcheck-databas: SSH rules for debug level

[Todd Troxell]

On Tue, Mar 29, 2005 at 12:04:15AM +0200, maximilian attems wrote:
> On Thu, 24 Mar 2005, Todd Troxell wrote:
> 
> > Hi Jari,
> > 
> > On Thu, Mar 24, 2005 at 10:17:39AM +0200, Jari Aalto wrote:
> > > If it were possible, please add rules to ignore SSH debug level messages
> > > like these:
> > > 
> > >   Mar 22 18:59:29 cante sshd[5673]: debug2: channel 4: rcvd adjust 66020
> > >   Mar 22 18:59:34 cante sshd[5673]: debug2: channel 4: window 32736 sent adjust 32800
> > > 
> > > Sometimes the SSH need to be run with DEBUG in order to pinpoint
> > > connection troubles and the logcheck messages tend to be rather long
> > > if these messages are included.
> > 
> > I think we probably don't want to have debug filters in place by default, but
> > this has given me an idea.
> > 
> > We get a lot of requests for start/stop messages and debug messages.  I'm not
> > really up for supporting debug messages, but if people want to write patches,
> > I will include a new "optional" rule directory (perhaps there is a better
> > name for this) that will be disabled by default, but allow for submission of
> > start/stop messages and debug messages.
> > 
> > Sound good?
> 
> ok *fun*, would also be able to add another layer of confusion
> for our users.
> 
> /me prefers kiss.
> 
> i would just close such requests with the remark that local-foo rules,
> are very easily added for such generic cases,
> but that they are not acceptable upstream.
> 
> we already ship that many rule that on my lame p1 print server at
> university the logcheck runs are quite "felt" when logged in.

Right, these would be disabled by default, so users would have to enable this
if they wanted to expend more cpu cycles.

If you think it is confusing, maybe we should just include them as
"documentation" ?

It just seems good in the interests of future projects to catalog as many
patterns as we can, especially if we don't have to promise maintenance.

-- 
[   Todd J. Troxell                                         ,''`.
      Student, Debian GNU/Linux Developer, SysAdmin, Geek  : :' :
      http://debian.org || http://rapidpacket.com/~xtat    `. `' 
                                                             `-     ]
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
Url : http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20050328/31e765ca/attachment.pgp