CentOS - Jul 2015 - rsyslog.conf

Windsor Dave (AdP/TEF7) wrote:
>> Behalf Of Leon Fauster
>>Am 22.07.2015 um 17:41 schrieb Windsor Dave (AdP/TEF7)
>> <Dave.Windsor at us.bosch.com>:
>>> Sorry for the top post, Outlook defaults strike again.....
>>
>>Outlook forces you to write above ? :-)
>
> Perhaps I should say instead that it "strongly encourages" top
posting,
> and all our internal emails follow that convention.
>
> It's habit-forming.... :-)
>
> Best regards
Yeah, and it's an M$ innovation I *really* dislike. I've had
disagreements
with my wife about that. What was it, Lookout, er Outlook '08 that did
that?

The *real* issue is that the way email traditionally was, with bottom
posting, or intercollation, made it *readable*, and esp. if you come into
a thread late, you could figure out what was going on.

I don't know of any written language on the planet that reads from the
bottom up... and if *anyone* doesn't top post, like a lot of us, it makes
it unreadable (up, down, up, down, down, up....)... which is why the
generally-agreed convention on every mailing list I'm on is traditional
format.

       mark "Kill Bill...."

On Thu, July 23, 2015 9:31 am, m.roth at 5-cent.us
wrote:
> Windsor Dave (AdP/TEF7) wrote:
>>> Behalf Of Leon Fauster
>>>Am 22.07.2015 um 17:41 schrieb Windsor Dave (AdP/TEF7)
>>> <Dave.Windsor at us.bosch.com>:
>>>> Sorry for the top post, Outlook defaults strike again.....
>>>Outlook forces you to write above ? :-)
>> Perhaps I should say instead that it "strongly encourages"
top posting,
and all our internal emails follow that convention.
>> It's habit-forming.... :-)
>> Best regards
>
> Yeah, and it's an M$ innovation I *really* dislike. I've had
disagreements
> with my wife about that. What was it, Lookout, er Outlook '08 that did
that?
>
> The *real* issue is that the way email traditionally was, with bottom
posting, or intercollation, made it *readable*, and esp. if you come
into
> a thread late, you could figure out what was going on.
"Come to the thread late" argument is the only rationale for "no
top
posting" in case of mail lists I can figure myself. Plus to have all
messages in some standard format.

I hope, the following will make piece between you and your wife. In
regular e-mail exchange both parties are constantly "in sync", thus
understand what previous statements this particular message deals with.
Therefore I personally find it advantageous in private exchange to have
new information - i.e. message I'm writing - be right at the top of
current e-mail. This is my current message I want my recipient to read
(but the rest of exchange is after it as well for recipient's
convenience). I can say many bad words about Microsoft, but this rationale
for private mail exchange is something I will not blame them about.

So far I collected two arguments to not "top post" on mail lists:

1. standardized format of all messages with answers (like the whole thread
in front of your eyes, and it is always in the same format)

2. easier reading for "new comers" to the thread: in chronological
order.

Any others rationales?

Valeri
>
> I don't know of any written language on the planet that reads from the
bottom up... and if *anyone* doesn't top post, like a lot of us, it
makes
> it unreadable (up, down, up, down, down, up....)... which is why the
generally-agreed convention on every mailing list I'm on is traditional
format.
>
>        mark "Kill Bill...."
>
> _______________________________________________
> CentOS mailing list
> CentOS at centos.org
> http://lists.centos.org/mailman/listinfo/centos
>

++++++++++++++++++++++++++++++++++++++++
Valeri Galtsev
Sr System Administrator
Department of Astronomy and Astrophysics
Kavli Institute for Cosmological Physics
University of Chicago
Phone: 773-702-4247
++++++++++++++++++++++++++++++++++++++++

Physically dragging the thread back on topic...

I really am going crazy, trying to deal with the hourly logs from the
loghost. We've got 170+ servers and workstations... but a *very* large
percentage of what's showing up is from his bloody new fedora 22, with its
idiot systemd logging of *ever* selinux message to /var/log/messages.

I tried creating a rule, /etc/rsyslog.d/audit.conf, that reads:

if $msg contains "audit" and $msg,contains,'res=success' then
-

but that seemed to send *everything* to /dev/null. That was my best guess,
based on googling (yahooing?) and man pages. Can anyone tell me what's
wrong with that syntax?

       mark

On Thu, Jul 23, 2015 at 01:19:44PM -0400, m.roth at 5-cent.us
wrote:
> I really am going crazy, trying to deal with the hourly logs from the
> loghost. We've got 170+ servers and workstations... but a *very* large
> percentage of what's showing up is from his bloody new fedora 22, with
its
> idiot systemd logging of *ever* selinux message to /var/log/messages.
systemctl enable auditd
systemctl start auditd

Now your SELinux (and other audit) logs are going to
/var/log/audit/audit.log. 

-- 
Jonathan Billings <billings at negate.org>