On Mon, 24 Jul 2023, 12:33 Thomas Parmelan, <tom+deb...@ankh.fr.eu.org> wrote:
> Le vendredi 21 juillet 2023 à 23:32, d'après > > > > (or stop using rsyslog entirely). > > I quite like my old habits wrt to /var/log/* :p > > But I now understand that all that is logged via rsyslog comes from > systemd-journald anyway, so there's actually no point for logcheck to > check both rsyslog files and the journal! I instructed logcheck to only > look at the journal, and I therefore no longer have my "duplicates" > problem. Maybe that should be the new default for the logcheck package, > or at least having some explicit documentation about it? > i think that might be premature to chamge the default - it would require people using rsyslog to change a conffile, whereas the current default should work for everyone. But agree the docs need a regresh. a quick win would be to add a comment to say how to disable checking of syslog. > This might be overkill, but we could make the pre-processing of log > > files be more customisable, so the user could choose whatever mangling > > of timestamps, whitespace and/or sorting they want. > [...] > > The possibility of setting JOURNALCTL_OPTS would be great! I think the > pre/post-processing customisation is a good idea too, to move all that > logic from the code to the configuration. > cool. this does seem the way to go (there are other priorities, but consider it on the todo list!)
