[Logwatch-Devel] Ideas for 6.1: Normalized Umatched processing

Kenneth Porter shiva at sewingwitch.com
Thu Feb 24 09:50:18 MST 2005

I'd like to suggest moving all Unmatched processing to Logwatch.pm. 
Currently it's handled in two distinct ways: Either by appending the 
unmatched strings to an array (which generates tons of lines in the report 
for some noisy services) or by building a hash of incidence counts keyed by 
content. The hash loses the original ordering of multi-line stuff, though. 
Perhaps the hash could remember the order that lines are first seen, and 
report them in that order.

I noticed the noisiness of this as a result of debugging my ntp config 
yesterday, so I've got a lot of unrecognized startup/shutdown strings 
repeated many times in the report.

More information about the Logwatch-Devel mailing list