Logcheck devel - Sep 2004 - dedup and sort rules

A non-text attachment was scrubbed...
Name: parse_logcheck
Type: application/octet-stream
Size: 3860 bytes
Desc: not available
Url :
http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20040901/b1727d89/attachment.obj

On Wed, Sep 01, 2004 at 02:59:35PM +0200, Michel Verdier
wrote:
> Hi,
> 
Hello Michel
> Migrating from woody to sarge I decided to automate logcheck update. Here
> is a script which :
> - sorts rules
> - suppress duplicate rules in a same file
> - checks duplicate rules in files in a same directory
> - adds debian .dpkg-dist files into old files
This seems like a useful script for users who manage their own rules.  I'm
NOT going to think about automating this in sarge, but perhaps later. 
Regardless I would like to include it with the current logcheck package,
perhaps as documentation.
> Also I prefer to read mails in a thread so I patched logcheck to always
> have the same subject :
> 
> *** /usr/sbin/logcheck.orig Sat Aug 14 04:56:24 2004
> --- /usr/sbin/logcheck  Fri Aug 27 19:26:33 2004
> ***************
> *** 253,258 ****
> --- 253,261 ----
>       if [ $ADDTAG = "yes" ]; then
>           subject="[logcheck] $subject"
>       fi
> +     if [ "x$SUBJECT" != "x" ]; then
> +         subject="$SUBJECT"
> +     fi
>   
>       if [ $MAILOUT -eq 1 ]; then
>         debug "Sending report to STDOUT"
> 
> In /etc/logcheck/logcheck.conf I added :
> 
> SUBJECT="[logcheck] `hostname`"
This seems like a good idea post-sarge for the sake of threading, but I'd
probably implement this differently.

Please file an appropriate wishlist bug.  Thanks!

-- 
[   Todd J. Troxell                                         ,''`.
      Student, Debian GNU/Linux Developer, SysAdmin, Geek  : :' :
      http://debian.org || http://rapidpacket.com/~xtat    `. `' 
                                                             `-     ]
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
Url :
http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20040905/95847f5d/attachment.pgp

On Fri, 01 Oct 2004, Michel Verdier wrote:
> maks attems <debian at sternwelten.at> a ?crit :
> 
> > hmm i should have better followed the code,
> > the script does not pay at _all_ attention to file permissions.
> > i'm not shure if we want to pass the to our users.
> 
> it is supposed to be run by root after an upgrade
> what would you like ?
shure but,
it saves the newfile without regard of previous group ownership
of logcheck group nor does it pay attention to the file permisions
of the rulefiles: 640
you can't place your bet on roots umask, he may legitemly have
umask 077 and than any of your newly written files will not be
readable for logcheck runs.
 
> > i'm not familiar enough with your code to change it in only
> > warn on duplicate rules but do not sort or rewrite files.
> 
> I could add option to sort and rewrite
options on startup for the available actions would be great,
i would like to run it sometimes without any action,
but just the warning of duplicate rules.

pending aboves rewrite, i'v removed the script from cvs,
as i did not consider it stable enough to push it into sarge.
as soon as aboves concerns are addresssed, i'll reconsider.
thanks for your feedback.

ps please do not exclude logcheck-debel from cc inputs. thx :)

--
maks