On Thu, 20 Feb 2003 22:20:28 +0100 Erich Schubert <er...@debian.org> wrote: > > I don't think that logcheck is the right place for tigger vaules, as I > > would like to keep logcheck as simple as possible. Would it be ok if I > > closed this wishlist bug ? > > No, please keep it open. Maybe tag it wontfix if you think it can't be > done due to logchecks design, but it isn't "fixed". > > And i still would like to have these trigger values. Like don't caring > about 2 login failures per hour, but when there are more i'd like to see > this in my logcheck report.
This bug is c 20 years old, it's been tagged wontfix, but actually the syslog-summary support allows the user to do most of this, by writing a custom sysog-summary script to process log entries before reporting. such a script could group or re-filter and only pass lines through if they are common. it could even maintain its own state (the only bit that might not work is that if the summary script decides there is nothing to report i didnt test if logcheck would send a blank report) so rather than "wontfix" I think we should close this
