Re: System log monitor
This is a small followup to my last message.
After thinking a bit about it, I think it might be better (performance-wise and
when multiple files include the same rules - this will happen during the
transitition period when packages start to bring logcheck rules files, but when
they are still covered by the logcheck-shipped defaults) to use an
update-logcheck script (like update-modules) that pre-generates the rules for
logcheck.sh. Then they do not have to be generated during run-time and therefore
some fancy sorting and filtering of duplicates can be done without getting
performance problems.
What do you think ? The user (and postinst scripts of packages containing
logcheck rules files) would only need to call the update-modules script after
making changes.
There's only one minor problem: Shipping files for update-modules is easy, since
modutils is required and therefore /etc/modutils should always be present. But
since logcheck is only optional, should packages still ship files in
/etc/logcheck/*.d/ although they will not be used if logcheck is not installed ?
At the moment, I do not know an easy way to install files conditionally without
losing the inclusion in the package-files database - i.e. the files should not
be generated in postinst, but contained in the package (is there any thing like
this in dpkg ?).
best greets,
Rene
Reply to: