[Logcheck-devel] Bug#542663: logcheck: /etc/cron.d/logcheck runs too often (now every 2 hours)

[martin f krafft]

also sprach Jari Aalto <jari.aalto at cante.net> [2009.08.21.1801 +0200]:
> If logcheck is installed in NN (where NN is two digit number)
> Debian servers, those messages pile up pretty quickly.

Please help write filters to prevent them.

> We must also keep in mind the extra burden the logcheck puts on system
> when it scan logs with heavy regular expressions.

Yes, logcheck is a hog. Regexp macros, a regexp compiler, and
ideally a new code base would fix that.

> To put things in perspective, it can be argued that messages from
> IDS systems or smartmond are much more important than logchecks;
> and they do come when error is detected.
>
> Please ship with 24h, which would be more appropriate and expected
> default.

Then you get one huge message and the chance of overlooking
something is larger IMHO.

I doubt we will change the default, but I am sure we would accept
patches that added a debconf question about the periodicity of
logcheck runs.

-- 
 .''`.   martin f. krafft <madduck at d.o>      Related projects:
: :'  :  proud Debian developer               http://debiansystem.info
`. `'`   http://people.debian.org/~madduck    http://vcs-pkg.org
  `-  Debian - when you have better things to do than fixing systems
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 197 bytes
Desc: Digital signature (see http://martin-krafft.net/gpg/)
URL: <http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20090821/ee0edee0/attachment.pgp>