Your message dated Sun, 29 Dec 2024 21:48:53 +0000
with message-id
<caj3buorismatfsxdby8n88yp-g-ymzojq-y6pp1swqhse2g...@mail.gmail.com>
and subject line Re: I was running my own syslog-summary
has caused the Debian Bug report #198762,
regarding remove support for syslog-summary which is dead
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
198762: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=198762
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: logcheck
Version: 1.2.54
Severity: wishlist
Hi, I have a wishlist request. If there's interest in this
feature, I'm willing to look into implementing it.
I'd like to be able to configure, for specific messages or
for all messages, to only show the first N occurrences of a
message (and report number of total occurences).
For example, sometimes NTP gets misconfigured and spews a
message once per minute. If I don't fix this problem right
away, the "security events" log gets drowned in noise.
I get messages like this:
Feb 24 22:02:41 hostname ntpd_initres[3359]: ntpd returns a permission denied
error!
Feb 24 22:03:41 hostname ntpd_initres[3359]: ntpd returns a permission denied
error!
Feb 24 22:04:41 hostname ntpd_initres[3359]: ntpd returns a permission denied
error!
Feb 24 22:05:41 hostname ntpd_initres[3359]: ntpd returns a permission denied
error!
In this case, it would be nice if the email simply reports
that the message, which other than timestamp is identical,
repeats for a total of 60 times, 54 occurrences elided.
Another use case is if I have a syntax error in my
SpamAssassin config file. Every time an email arrives, I
also get an additional email like
Feb 24 22:02:07 hostname spamd[4899]: config: failed to parse line, skipping:
FOO 1 line with syntax error
Feb 24 22:02:07 hostname spamd[4899]: config: failed to parse line, skipping:
FOO 2 line with syntax error
Feb 24 22:02:07 hostname spamd[4899]: config: failed to parse line, skipping:
FOO 3 line with syntax error
Feb 24 22:02:07 hostname spamd[4899]: config: failed to parse line, skipping:
FOO 4 line with syntax error
Feb 24 22:02:07 hostname spamd[4899]: config: failed to parse line, skipping:
FOO 5 line with syntax error
Feb 24 22:02:17 hostname spamd[4899]: config: failed to parse line, skipping:
FOO 1 line with syntax error
Feb 24 22:02:17 hostname spamd[4899]: config: failed to parse line, skipping:
FOO 2 line with syntax error
Feb 24 22:02:17 hostname spamd[4899]: config: failed to parse line, skipping:
FOO 3 line with syntax error
Feb 24 22:02:17 hostname spamd[4899]: config: failed to parse line, skipping:
FOO 4 line with syntax error
Feb 24 22:02:17 hostname spamd[4899]: config: failed to parse line, skipping:
FOO 5 line with syntax error
Feb 24 22:03:41 hostname spamd[4899]: config: failed to parse line, skipping:
FOO 1 line with syntax error
Feb 24 22:03:41 hostname spamd[4899]: config: failed to parse line, skipping:
FOO 2 line with syntax error
In this second example, the duplicated lines aren't
consecutive, though groups of them are.
--- End Message ---
--- Begin Message ---
[snip: bugs that ended up being: remove support for running
syslog-summary from logcheck, dating back to ~ 2020!]
[ snip: discussion of local version of syslog-summary]
> https://git.alphanet.ch/gitweb/?p=various;a=blob;f=logcheck/syslog-summary;h=dcfe82b9ab2065309dc39f929d0d5c9055c75f55;hb=HEAD
I only just spotted this - on 11 Nov 2024 (approx 3 days after the
last message in this bug!), a new syslog-summary
was uploaded to debian (see https://tracker.debian.org/pkg/syslog-summary).
So im closing this bug against logcheck which asked to remove the
support - luckily no-one actioned it in the last few years!
If anyone reading thinks there is something to do in logcheck, please
open a new bug!
I'm cc'ing the syslog-summary maintainers in case they want to check
out marc's version, linked above
--- End Message ---
