[Logwatch-Devel] Ideas for 6.1: Normalized Umatched processing
shiva at sewingwitch.com
Thu Feb 24 09:50:18 MST 2005
I'd like to suggest moving all Unmatched processing to Logwatch.pm.
Currently it's handled in two distinct ways: Either by appending the
unmatched strings to an array (which generates tons of lines in the report
for some noisy services) or by building a hash of incidence counts keyed by
content. The hash loses the original ordering of multi-line stuff, though.
Perhaps the hash could remember the order that lines are first seen, and
report them in that order.
I noticed the noisiness of this as a result of debugging my ntp config
yesterday, so I've got a lot of unrecognized startup/shutdown strings
repeated many times in the report.
More information about the Logwatch-Devel