[Logcheck-devel] Bug#443171: Bug#443171: rules to ignore acpid messages

Hanspeter Kunz hp at edelkunz.ch
Fri Sep 21 15:12:58 UTC 2007


On Fri, 2007-09-21 at 16:01 +0100, martin f krafft wrote:
> also sprach Justin Pryzby <jpryzby+d at quoininc.com> [2007.09.21.1548 +0100]:
> > I really don't want anyone to use .*$.
> 
> Fair enough. Now what do we do in Hanspeter's case? If the end of
> the line could be one of three messages, by all means, use (a|b|c),
> but if it could be anything (and ACPI events kinda sound a bit like
> it could be anything...)?

I came to the conclusion, that having separate and thus more specific
rules for the different acpid events makes more sense. Because only then
it is possible to tell what messages are being ignored by just looking
at the rule. If rules are more general, like the ones I suggested, this
is not possible. From a computer science viewpoint such more general
rules might be more elegant, but from a systems admin view the latter is
much more convienient. 

If there is a consensus about that, I will re-engineer the acpid rules.







More information about the Logcheck-devel mailing list