Logcheck devel - Apr 2011 - Bug#623298: logcheck: excessive CPU use by egrep

Package: logcheck
Version: 1.3.13
Severity: normal


Currently I have an egrep sitting on 64 minutes cpu time that was
run from the logcheck process.

On other logcheck runs, some of the data finally appearing has been
due to fetchnews (part of the leafnode package) and the kernel.

Have any of the developers been looking at which rules use the most
cpu time and how than can be minimised?

-- System Information:
Debian Release: wheezy/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (500, 'testing'), (500,
'stable'), (1, 'experimental')
Architecture: i386 (i686)

Kernel: Linux 2.6.38.2 (SMP w/1 CPU core)
Locale: LANG=en_AU.UTF-8, LC_CTYPE=en_AU.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash

Versions of packages logcheck depends on:
ii  adduser                       3.112+nmu2 add and remove users and groups
ii  cron                          3.0pl1-116 process scheduling daemon
ii  exim4-daemon-light [mail-tran 4.75-2     lightweight Exim MTA (v4) daemon
ii  lockfile-progs                0.1.15     Programs for locking and unlocking
ii  logtail                       1.3.13     Print log file lines that have not
ii  mime-construct                1.11       construct/send MIME messages from 
ii  sysklogd [system-log-daemon]  1.5-6      System Logging Daemon

Versions of packages logcheck recommends:
ii  logcheck-database             1.3.13     database of system log rules for t

Versions of packages logcheck suggests:
ii  syslog-summary                1.14-2     summarize the contents of a syslog

-- Configuration Files:
/etc/cron.d/logcheck changed:
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
MAILTO=root
@reboot         logcheck    if [ -x /usr/sbin/logcheck ]; then ionice -c3 nice
-n10 /usr/sbin/logcheck -R; fi
2 * * * *       logcheck    if [ -x /usr/sbin/logcheck ]; then ionice -c3 nice
-n10 /usr/sbin/logcheck; fi

/etc/logcheck/logcheck.conf [Errno 13] Permission denied:
u'/etc/logcheck/logcheck.conf'
/etc/logcheck/logcheck.logfiles [Errno 13] Permission denied:
u'/etc/logcheck/logcheck.logfiles'

-- debconf-show failed

This bug is due to leafnode even at minimal logging creating about 100 
MiB of log entries like reported in:

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=623302

These entries were of the form:

Apr 19 00:03:09 victoria fetchnews[3335]: gmane.linux.kernel: killed 
79950 (<200212181942.gBIJgp418497 at devserv.devel.redhat.com>), too old 
(3043 > 15) days

As this was the largest proportion of junk log entries, perhaps logcheck 
should filter these entries out before performing other filtering?

Regards,

Arthur.

Your message dated Fri, 8 Jul 2011 15:46:49 +0200
with message-id <20110708134649.GA5817 at carbon.vonhaugwitz.com>
and subject line Re: [Logcheck-devel] Bug#623298: Acknowledgement (logcheck:
excessive CPU use by egrep)
has caused the Debian Bug report #623298,
regarding logcheck: excessive CPU use by egrep
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner at bugs.debian.org
immediately.)


-- 
623298: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=623298
Debian Bug Tracking System
Contact owner at bugs.debian.org with problems
-------------- next part --------------
An embedded message was scrubbed...
From: Arthur Marsh <arthur.marsh at internode.on.net>
Subject: logcheck: excessive CPU use by egrep
Date: Tue, 19 Apr 2011 13:20:14 +0930
Size: 3871
URL:
<http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20110708/1dcb7e0f/attachment.mht>
-------------- next part --------------
An embedded message was scrubbed...
From: Hannes von Haugwitz <hannes at vonhaugwitz.com>
Subject: Re: [Logcheck-devel] Bug#623298: Acknowledgement (logcheck: excessive
CPU use by egrep)
Date: Fri, 8 Jul 2011 15:46:49 +0200
Size: 2751
URL:
<http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20110708/1dcb7e0f/attachment-0001.mht>