Thanks for the info and thoughts.
The idea would do something like your second suggestion; run logcheck
on apt logs separately, but within Debian instead of just on my system.
Perhaps we could also distribute the ignore regexes across packages
like logcheck itself does.
(i wonder how well this distributed model works - i dont think most packages have understood the violations layer, and rules do not seem to be kept updated (also true of logcheck-database). it also means logcheck-database is less useful for other consumers, and creates cruft for people that do not use logcheck or who want to write all the rules themselves)
PS: do you know if logcheck supports printing nearby ignored lines for
context for each non-ignored log message that was printed? That would
be essential for this apt log filtering because the non-ignored
messages are usually produced by package maintainer scripts and the
ignored nearby lines contain the name of the relevant packages.
it doesnt out of the box - yet: but adding support for replacing grep wih faster tools like rg or ag is already on my list for bookworm and the implementation-in-progress allows other options such as -C etc to be passed through.
I assume grep does something sensible when outputting context with -f but there would be some subtleties with how it interacts with the violations and violations-ignore layers and sorting/collating of rules.... simplifying that mess is also on the list.