[Logcheck-devel] Fwd: seamus.madduck.net 2006.07.23.0050 System Events

[Todd Troxell]

On Wed, Jul 26, 2006 at 09:42:17AM +0100, martin f krafft wrote:
> also sprach Todd Troxell <ttroxell at debian.org> [2006.07.26.0405 +0100]:
> > Yes, yes it should.  There was a bug report about this
> > somewhere...   Gah!
> 
> Yes, I remember, but I could not find it.

Just a general "Gah!", not necessarily directed at you :)  Anyway, it's
#254542: Change violations.d override

> > To be clear, the violations.ignore.d should filter things are the ignore.d
> > level.  Currently it does not.
> 
> Should we declare it a feature and call violations.ignore.d
> a deescalation filter instead?

The majority of emails I get about logcheck are confused admins wondering why
a rulefile doesn't work, when it's just because lines are being pulled by
violations.d.

Eh, It definitely makes things more complicated.  The benefit would not be
great for me, but I tend to read logcheck mails  without really caring about
which level things show up under.  I may be a bad judge on this one, but I'd
like to see it changed.  Of course, I'm open to discussion about it.

-- 
Todd Troxell
http://rapidpacket.com/~xtat