Logcheck devel - Mar 2005 - Bug#301175: logcheck-databas: SSH rules for debug level

Package: logcheck-database
Version: 1.2.35
Severity: wishlist

If it were possible, please add rules to ignore SSH debug level messages
like these:

  Mar 22 18:59:29 cante sshd[5673]: debug2: channel 4: rcvd adjust 66020
  Mar 22 18:59:34 cante sshd[5673]: debug2: channel 4: window 32736 sent adjust
32800

Sometimes the SSH need to be run with DEBUG in order to pinpoint
connection troubles and the logcheck messages tend to be rather long
if these messages are included.

-- System Information:
Debian Release: 3.1
  APT prefers unstable
  APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: i386 (i686)
Kernel: Linux 2.6.10-1-686
Locale: LANG=C, LC_CTYPE=C (charmap=ISO-8859-1) (ignored: LC_ALL set to en_US)

Versions of packages logcheck-database depends on:
ii  debconf [debconf-2.0]         1.4.46     Debian configuration management sy

-- debconf information excluded

Hi Jari,

On Thu, Mar 24, 2005 at 10:17:39AM +0200, Jari Aalto
wrote:
> If it were possible, please add rules to ignore SSH debug level messages
> like these:
> 
>   Mar 22 18:59:29 cante sshd[5673]: debug2: channel 4: rcvd adjust 66020
>   Mar 22 18:59:34 cante sshd[5673]: debug2: channel 4: window 32736 sent
adjust 32800
> 
> Sometimes the SSH need to be run with DEBUG in order to pinpoint
> connection troubles and the logcheck messages tend to be rather long
> if these messages are included.
I think we probably don't want to have debug filters in place by default,
but
this has given me an idea.

We get a lot of requests for start/stop messages and debug messages.  I'm
not
really up for supporting debug messages, but if people want to write patches,
I will include a new "optional" rule directory (perhaps there is a
better
name for this) that will be disabled by default, but allow for submission of
start/stop messages and debug messages.

Sound good?

Cheers,
-- 
[   Todd J. Troxell                                         ,''`.
      Student, Debian GNU/Linux Developer, SysAdmin, Geek  : :' :
      http://debian.org || http://rapidpacket.com/~xtat    `. `' 
                                                             `-     ]

On Thu, 24 Mar 2005, Todd Troxell wrote:
> Hi Jari,
> 
> On Thu, Mar 24, 2005 at 10:17:39AM +0200, Jari Aalto wrote:
> > If it were possible, please add rules to ignore SSH debug level
messages
> > like these:
> > 
> >   Mar 22 18:59:29 cante sshd[5673]: debug2: channel 4: rcvd adjust
66020
> >   Mar 22 18:59:34 cante sshd[5673]: debug2: channel 4: window 32736
sent adjust 32800
> > 
> > Sometimes the SSH need to be run with DEBUG in order to pinpoint
> > connection troubles and the logcheck messages tend to be rather long
> > if these messages are included.
> 
> I think we probably don't want to have debug filters in place by
default, but
> this has given me an idea.
> 
> We get a lot of requests for start/stop messages and debug messages. 
I'm not
> really up for supporting debug messages, but if people want to write
patches,
> I will include a new "optional" rule directory (perhaps there is
a better
> name for this) that will be disabled by default, but allow for submission
of
> start/stop messages and debug messages.
> 
> Sound good?
ok *fun*, would also be able to add another layer of confusion
for our users.

/me prefers kiss.

i would just close such requests with the remark that local-foo rules,
are very easily added for such generic cases,
but that they are not acceptable upstream.

we already ship that many rule that on my lame p1 print server at
university the logcheck runs are quite "felt" when logged in.

but perhaps your optional makes everyone happy. :-)

was away for easter will see if i have any small things pending.
a++ maks

| Hi Jari,
| 
| On Thu, Mar 24, 2005 at 10:17:39AM +0200, Jari Aalto wrote:
| > If it were possible, please add rules to ignore SSH debug level messages
| > like these:
| > 
| >   Mar 22 18:59:29 cante sshd[5673]: debug2: channel 4: rcvd adjust 66020
| >   Mar 22 18:59:34 cante sshd[5673]: debug2: channel 4: window 32736 sent
adjust 32800
| > 
| > Sometimes the SSH need to be run with DEBUG in order to pinpoint
| > connection troubles and the logcheck messages tend to be rather long
| > if these messages are included.
| 
| I think we probably don't want to have debug filters in place by default,
but
| this has given me an idea.
| 
| We get a lot of requests for start/stop messages and debug messages.  I'm
not
| really up for supporting debug messages, but if people want to write patches,
| I will include a new "optional" rule directory (perhaps there is a
better
| name for this) that will be disabled by default, but allow for submission of
| start/stop messages and debug messages.
| 
| Sound good?

Sure, please include the directory and I'm sure people contribute
patches. Some debug messages are more important than the others, so
the fileter will work equally well for those cases too.

Jari