On Fri, 2007-09-21 at 10:01 +0100, martin f krafft wrote: > also sprach Hanspeter Kunz <[EMAIL PROTECTED]> [2007.09.21.0853 +0100]: > > It is a good thing to have rules that are as specific as possible. > > But they should only be as specific as needed, don't you agree? > > (or am I missing something here?) > > > > The rules above are unspecific (to some extent) because it is > > their purpose to match to a lot of cases. So, there is really no > > need to be more specific. If so, many more rules would be > > necessary (which is again not helpful for logchecks performance). > > I didn't make the submission rules, I just observed them. The only > thing I can say is that performance is not something I worry about > with logcheck, or I'd have long orphaned the package. :)
I didn't mean that the submission rules are unspecific. What I meant is, that the logcheck rules I submitted are unspecific, because it is their purpose to match a lot of different lines (with the same straing pattern though) in syslog. And the fact that you do not worry about performance does not mean that I shouldn't, does it? :-) So, in short: I am convinced that the (logcheck) rules I submitted are best kept as they are (not using an $ at the end), because it is their intention to be unspecific. If you agree, I can also submit them as a patch. -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
