[Logcheck-devel] Bug#443171: Bug#443171: Bug#443171: rules to ignore acpid messages

[Hanspeter Kunz]

On Fri, 2007-09-21 at 10:01 +0100, martin f krafft wrote:
> also sprach Hanspeter Kunz <hkunz at ifi.uzh.ch> [2007.09.21.0853 +0100]:
> > It is a good thing to have rules that are as specific as possible.
> > But they should only be as specific as needed, don't you agree?
> > (or am I missing something here?)
> > 
> > The rules above are unspecific (to some extent) because it is
> > their purpose to match to a lot of cases. So, there is really no
> > need to be more specific. If so, many more rules would be
> > necessary (which is again not helpful for logchecks performance).
> 
> I didn't make the submission rules, I just observed them. The only
> thing I can say is that performance is not something I worry about
> with logcheck, or I'd have long orphaned the package. :)

I didn't mean that the submission rules are unspecific. What I meant is,
that the logcheck rules I submitted are unspecific, because it is their
purpose to match a lot of different lines (with the same straing pattern
though) in syslog.

And the fact that you do not worry about performance does not mean that
I shouldn't, does it? :-)

So, in short: I am convinced that the (logcheck) rules I submitted are
best kept as they are (not using an $ at the end), because it is their
intention to be unspecific.

If you agree, I can also submit them as a patch.