Hello,

Since Debian Bookworm I get emails from logcheck because lines from
journalctl are no more ignored.

For example in the logcheck email I have:
juin 25 13:39:27 zotac smartd[548]: Device: /dev/sda [SAT], SMART Usage Attribute: 194 Temperature_Celsius changed from 34 to 35

Note the first word of the line: "juin". It is the french word for June.

It looks like journalctl now displays the month using the configured
locale.

Compare:
# journalctl -t smartd -S "Jun 25 10:00:00"
juin 25 11:09:27 zotac smartd[548]: Device: /dev/sda [SAT], SMART Usage Attribu>
juin 25 13:39:27 zotac smartd[548]: Device: /dev/sda [SAT], SMART Usage Attribu>

with:
# LANG=C journalctl -t smartd -S "Jun 25 10:00:00"
Jun 25 11:09:27 zotac smartd[548]: Device: /dev/sda [SAT], SMART Usage Attribut>
Jun 25 13:39:27 zotac smartd[548]: Device: /dev/sda [SAT], SMART Usage Attribut

I have:
# cat /etc/default/locale
#  File generated by update-locale
LANG="fr_FR.UTF-8"

The patch is easy and attached.

The patch sets LANG to C before running logcheck: i can see this is a
solution that will work in the short-term.

I think it should be C.UTF-8 instead of plain C?

I suspect it would also work to simply write LANG=C into
/etc/logcheck/logcheck.conf (untested)

In the long-term:
- I wonder if locale is something we should allow the user to customize
anyway?
- what if rsyslog starts doing something similar? we cant change its locale
as we work after it has written the log.
- hardcoding locale means you wont be able to manually match things
logcheck reports to what you see when running journalctl by hand, unless
you know to.manually change the locale....  i dont see a way round this :(


But we should document that locale is fixed for journalctl (but not for
rsyslog!), and make the autopkgtests use a non-english locale as well to
help spot future issues.

LANG=C.UTF-8
at the end of /etc/logcheck/logcheck.conf and it works also fine for me.

It is a better solution since I do not have to patch a script for the same result.
Thanks for the suggestion.
2023-06-25T11:09:27.454813+02:00 zotac smartd[548]: Device: /dev/sda [SAT], SMART Usage Attribute: 194 Temperature_Celsius changed from 33 to 34
2023-06-25T13:39:27.531540+02:00 zotac smartd[548]: Device: /dev/sda [SAT], SMART Usage Attribute: 194 Temperature_Celsius changed from 34 to 35

Here the date does not include the month name (either Jun or juin).

My first patch was to change the \w{3} by \w+ in my personal rules. (for example in "^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) ...")
But since the problem was also present in "official" rules provided by the package it was not a good/practical solution.

I have no idea what the correct/best solution should be.

Bye

journalctl(1) in systemd 234+ supports `--output=short-iso-precise` option.

```
$ sudo journalctl --output=short-iso-precise -t kernel -S today |head
2024-01-21T00:00:01.070536+09:00 sugar kernel: audit: type=1400 audit(1705762801.065:10307): apparmor="DENIED" operation="capable" class="cap" profile="/usr/sbin/cupsd" pid=1358071 comm="cupsd" capability=12  capname="net_admin"
2024-01-21T04:09:57.478547+09:00 sugar kernel: PM: suspend entry (s2idle)
2024-01-21T04:09:57.482546+09:00 sugar kernel: Filesystems sync: 0.000 seconds
```

Regex "^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) " matches it.