1

I have logcheck running on my server, and it constantly e-mails me reams of warnings.

I go through and manually add the regular expressions, but it's getting tiresome quickly, and worse: I'm starting to ignore messages because of the sheer volume of crud it gets me (i.e., just found out my RAID array has been degraded for days).

I'm wondering if this is what everyone goes through, or if there's some shortcuts? i.e.:

  • Is there a repository of 'safe' .ignore files I can use?
  • Are there any tools to automate the making of .ignore rules?
  • Are there better solutions than logcheck?
Improve this question
2
  • I've started to collect my rule in public place on github at github.com/frlan/logcheck-local-rules -- but maybe this can be a nice project for a wiki or something.
    – frlan
    Feb 23, 2014 at 12:38
  • I've just setup my logcheck again and added some more regex for non-important log messages. So, now I have a status quo. I am excited when I have to add some more new rules. Hope not that soon. I've published my adoptions in my blog (see my profile).
    – Strubbl
    May 2, 2014 at 14:38

1 Answer 1

Reset to default
0

Just to make sure: you have installed the package "logcheck-database"? That is the "safe" ignore files already provided by the distribution.

You can do so on e.g. Debian by issuing the command:

apt-get install logcheck-database
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .