There are some log lines i'd like to know about, but only if they hit a
certain threshold value.
For example:

postfix/smtpd[13883]: warning: .*: RBL lookup error: Name service error .*

As long as this fails for single hosts i don't care.
But when it occurs let's say more than 15 times within an interval i'd
like to be notified (and maybe disable RBL lookups temporarily)

Thanks for your great work!

Greetings,
Erich

Erich,

I don't think that logcheck is the right place for tigger vaules, as I
would like to keep logcheck as simple as possible. Would it be ok if I
closed this wishlist bug ?

Thanks,

No, please keep it open. Maybe tag it wontfix if you think it can't be
done due to logchecks design, but it isn't "fixed".

And i still would like to have these trigger values. Like don't caring
about 2 login failures per hour, but when there are more i'd like to see
this in my logcheck report.

BTW: i'm thinking about writing a different logcheck system: i would
like my logcheck logs be split into different classes than "violations"
and "events". I would like to see "mail events", "authentification
failures" and such not mixed but separated in paragraphs.

Greetings,
Erich Schubert

This bug is c 20 years old, it's been tagged wontfix, but actually the
syslog-summary support allows
the user to do most of this, by writing a custom sysog-summary script
to process log entries before reporting. such
a script could group or re-filter and only pass lines through if they
are common. it could even maintain its own state

(the only bit that might not work is that if the summary script
decides there is nothing to report i didnt test if logcheck
would send a blank report)

so rather than "wontfix" I think we should close this