On Sun, 5 May 2024 20:51:12 +0100 Richard Lewis <[email protected]> wrote:
> 3. i have work in progress to allow you to tell logcheck to only > check a subset of the journal by passif arguments to journalctl. > Looking at the journalctl.man-page: > --unit ssh.service will only show messages from ssh > eg --system might exclude things like telegram (untested!) > eg --priority might also be helpful > eg _UID=0 might select only things run by root (but that would > probably exclude things run by special users like apache) > eg --priority might also help? > > This needs a small change in logcheck to make JOURNALCTL_OPTS > settable from the config file - this is WiP already! (logcheck > currently hardcoded this to an empty array) For a test I monkey patched logcheck to use hardcoded priority filter for journalctl output: root@time:~/logcheck-1.4.5+deb13u1/src# diff logcheck /usr/sbin/logcheck 56c56 < VERSION=unknown --- > VERSION=1.4.5+deb13u1 480,482c480 < local < JOURNALCTL_OPTS=() OPTS=() < JOURNALCTL_OPTS=(--priority=warning) --- > local JOURNALCTL_OPTS=() OPTS=() I also commented out the /var/log/syslog and /var/log/auth.log files in /etc/logcheck/logcheck.logfiles.d/syslog.logfiles As far as I can see it works. journalctl messages with priority lower than warning do not seem to be relevant for me. The filter removes a lot of noise and irrelevant info messages. Therefore it would be great to have the possibilty to set JOURNALCTL_OPTS in /etc/logcheck/logcheck.conf This would reduce the log spam and the necessity to maintain rule files dramatically. Thank you
