On Sun, 12 May 2024 at 19:57, Marc Haber <mh+debian-b...@zugschlus.de> wrote: > > On Sun, May 12, 2024 at 06:54:59PM +0100, R Lewis wrote: > > On Wed, 16 Jul 2008 23:15:51 +0200 Marc Haber > > <mh+debian-b...@zugschlus.de> wrote: > > > > > It would help with debugging to have an option that causes logcheck to > > > always look through the entire log file, ie not using logtail. > > > > Looking at this old bug from 2008: does the -t option meet this need? > > Not quite. Imagine: I have a system running logcheck hourly. At 11:00, I > get a mail with a log message from 10:55 that is not yet covered by the > rule. The stamp gets updated to 11:00. > > I now fix the rule that should have filtered the message. logcheck -t > will still only start checking a 11:00, so the test run will not prove > that the change has actually filtered the message from 10:55. > > Does this make the usecase clear?
Does logcheck-test help with that?
