[Logcheck-devel] moving rules out of logcheck-database into the packages

[Jamie L. Penman-Smithson]

On 3 Jul 2006, at 23:56, martin f krafft wrote:
> One of my gripes with logcheck is that it installs filters for
> packages that are not installed, and even for packages that are
> installed, it installs filters across multiple versions (e.g.
> postfix).

If you check the archives of logcheck-devel, you'll see that this has  
already been discussed in the past.

Moving logcheck rules into packages means that people get logcheck  
rules whether they use logcheck or not..

A possible solution to your gripe is a "which rules (do you|do you  
not) want installed" question in debconf.

> I think the Debian way is for packages to provide their own logcheck
> filters. Thus, in the very long-run, what I would really like to see
> is an effort to move the files into the respective packages.
> Obviously, not all maintainers will be happy with that, but if we
> can get consensus and a coordinated effort, I think we can go very
> far.

Some maintainers don't want to have to maintain logcheck rules. Most  
don't use logcheck. They forget to update the rules until a bug is  
filed, this is essentially the same situation as we have now, except  
that maintenance of logcheck rules is outsourced.

While the majority of rules provided by other packages are of high  
quality, there are some which are not - they are over-broad, or lack  
beginning/end of line metachars, in some cases these rules may  
represent a possible security risk.

> I'd be willing to coordinate the transition(s), but I'd like to hear
> what people have to say. I have heard the argument that it's best
> not to upset the status quo, but that just doesn't feel right to me
> -- we are dealing with Debian after all, so we *can* move ahead to
> provide better integration of logcheck with the rest of the archive.

Having logcheck rules moved out of logcheck breaks dedicated  
loghosts. It also makes it more difficult, or even impossible, for  
people to use logcheck on a different OS, since they will no longer  
have any logcheck rules to use.

While I agree that Debian should be our primary focus, I don't think  
we should just abandon everyone who does not use Debian without a  
_very good_ reason for doing so.

-j


-------------- next part --------------
A non-text attachment was scrubbed...
Name: PGP.sig
Type: application/pgp-signature
Size: 186 bytes
Desc: This is a digitally signed message part
Url : http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20060704/f748214d/attachment.pgp