On Thu, 18 May 2023, 04:45 Paul Wise, <p...@debian.org> wrote: > Thanks for the info and thoughts. > > The idea would do something like your second suggestion; run logcheck > on apt logs separately, but within Debian instead of just on my system. > Perhaps we could also distribute the ignore regexes across packages > like logcheck itself does.
(i wonder how well this distributed model works - i dont think most packages have understood the violations layer, and rules do not seem to be kept updated (also true of logcheck-database). it also means logcheck-database is less useful for other consumers, and creates cruft for people that do not use logcheck or who want to write all the rules themselves) > PS: do you know if logcheck supports printing nearby ignored lines for > context for each non-ignored log message that was printed? That would > be essential for this apt log filtering because the non-ignored > messages are usually produced by package maintainer scripts and the > ignored nearby lines contain the name of the relevant packages. > it doesnt out of the box - yet: but adding support for replacing grep wih faster tools like rg or ag is already on my list for bookworm and the implementation-in-progress allows other options such as -C etc to be passed through. I assume grep does something sensible when outputting context with -f but there would be some subtleties with how it interacts with the violations and violations-ignore layers and sorting/collating of rules.... simplifying that mess is also on the list.
