On Fri, 2007-09-21 at 16:01 +0100, martin f krafft wrote: > also sprach Justin Pryzby <[EMAIL PROTECTED]> [2007.09.21.1548 +0100]: > > I really don't want anyone to use .*$. > > Fair enough. Now what do we do in Hanspeter's case? If the end of > the line could be one of three messages, by all means, use (a|b|c), > but if it could be anything (and ACPI events kinda sound a bit like > it could be anything...)?
I came to the conclusion, that having separate and thus more specific rules for the different acpid events makes more sense. Because only then it is possible to tell what messages are being ignored by just looking at the rule. If rules are more general, like the ones I suggested, this is not possible. From a computer science viewpoint such more general rules might be more elegant, but from a systems admin view the latter is much more convienient. If there is a consensus about that, I will re-engineer the acpid rules. _______________________________________________ Logcheck-devel mailing list [email protected] http://lists.alioth.debian.org/mailman/listinfo/logcheck-devel
