Logcheck devel - Aug 2009 - Bug#542663: logcheck: /etc/cron.d/logcheck runs too often (now every 2 hours)

Package: logcheck
Version: 1.2.69
Severity: minor


The Default cron setup is:

    2 * * * *      logcheck    if [ -x /usr/sbin/logcheck ]; then nice -n10
/usr/sbin/logcheck; fi

This is extremely too often. Getting huge number of mail every two
hours is filling in the mailboxes.

A more appropriate default would be every 24h (once a day).

-- System Information:
Debian Release: squeeze/sid
  APT prefers testing
  APT policy: (990, 'testing'), (500, 'unstable')
Architecture: i386 (i686)

Kernel: Linux 2.6.26-1-686 (SMP w/1 CPU core)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash

Versions of packages logcheck depends on:
ii  adduser            3.110                 add and remove users and groups
ii  bsd-mailx [mailx]  8.1.2-0.20081101cvs-2 A simple mail user agent
ii  cron               3.0pl1-106            process scheduling daemon
ii  exim4-daemon-heavy 4.69-11               Exim MTA (v4) daemon with extended
ii  lockfile-progs     0.1.13                Programs for locking and unlocking
ii  logtail            1.2.69                Print log file lines that have not
ii  mailx              1:20081101-2          Transitional package for mailx ren
ii  rsyslog [system-lo 4.2.0-1               enhanced multi-threaded syslogd

Versions of packages logcheck recommends:
ii  logcheck-database             1.2.69     database of system log rules for t

Versions of packages logcheck suggests:
pn  syslog-summary                <none>     (no description available)

-- no debconf information

On Thu, Aug 20, 2009 at 08:51:21PM +0300, Jari Aalto
wrote:
> This is extremely too often. Getting huge number of mail every two
> hours is filling in the mailboxes.
Actually, it is every hour (at x:02).  But if logcheck is sending you
crap every hour, you need better rules, not a lazier schedule.  That'd
be like unplugging your smoke detector instead of moving it further from
the kitchen.

Could you file bug reports for the messages that are getting through?
> A more appropriate default would be every 24h (once a day).
I can't speak for other people, but when I was sysadmin, I wanted to be
informed of any problems *now*, not the day after.


-- 
<Overfiend_> Intel.  Bringing you the cutting-edge technology of 1979
             for 22 years now.

> martin f. krafft <madduck at d.o> 
> > Please ship with 24h, which would be more appropriate and expected
> > default.
> 
> Then you get one huge message and the chance of overlooking
> something is larger IMHO.
It is lot easier to look at one mail:

    - Search
    - filter (procmail or MUA means)
    - Forward to another admin for further look
      (people responsible for are XXXX, YYY ...)
    - delete or archibe mail with one command
> I doubt we will change the default, but I am sure we would accept
> patches that added a debconf question about the periodicity of
> logcheck runs.
It is a nuissance to have to deal with multiple mails. The default of 2
is too extreme.

Jari