[Logcheck-devel] Re: [Logcheck-commits] r1172 - in logcheck/trunk: debian rulefiles/linux/ignore.d.server

[martin f krafft]

also sprach Todd Troxell <ttroxell at debian.org> [2006.07.26.0358 +0100]:
> > * ignore.d.server/kernel: ignore interface link status changes.
> > If they are important, we would not be able to get mail about
> > them anyway.
> 
> I'm not completely convinced that this is a good idea.  This kind
> of activity could indicate tampering or equipment failure.  Are
> you getting this message regularly?

In retrospect, I think I will have to agree with you, but I wonder
whether it's logcheck's job to point this out. I suppose I should
revert that change... I am getting the message often but that's
because one of my servers is actually a laptop on a wireless link.
:)

I'll leave the filter for link status "up", but will remove the
"down" one. By logic of link status, they always come in pairs or
not at all. :)

-- 
 .''`.     martin f. krafft <madduck at debian.org>
: :'  :    proud Debian developer and author: http://debiansystem.info
`. `'`
  `-  Debian - when you have better things to do than fixing a system
 
mumlutlitithtrhreeaadededd s siigngnatatuurere
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature (GPG/PGP)
Url : http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20060726/442412d0/attachment.pgp