Re: Filter logcheck reboot messages?

[Sven Hartge <sven@svenhartge.de>]

Ulf Volmer <u.volmer@u-v.de> wrote:
> On 09.12.2017 15:37, Sven Hartge wrote:
>> Richard Hector <richard@walnut.gen.nz> wrote:
 
>>> Nobody else uses logcheck? Everyone is fine with how it works?
>> 
>> I use logcheck on all systems and I see no need to change it. In
>> fact, I *want* the reboot messages and filtering them out would be a
>> regression for me.

> Agree. i'm using logcheck to give me information about unexpected
> behavior and i count a reboot as unexpected behavior.

This is also the reason why I prefer logcheck over logwatch. 

With logcheck you define "normal behavior" and it gets filtered out. The
rest is then per definition "abnormal behavior" and gets send via mail.

For logwatch on the other side you define the "abnormal behavior"
beforehand, which I find much more inconvenient and difficult, because I
mostly don't know if something is normal or not before I can see it.

S°

-- 
Sigmentation fault. Core dumped.