#376106 idea: interpolation in filter files

Package:
logcheck
Source:
logcheck
Submitter:
martin f krafft
Date:
2023-03-14 18:21:02 UTC
Severity:
wishlist
Tags:
#376106#3
Date:
2006-06-30 09:37:13 UTC
From:
To:
Since logcheck processes all filter files anyway (instead of just
feeding them to egrep -f), the following may be trivial to
implement:

It would be nice if logcheck filter files would honour variables,
e.g.:

  # LEAD=^\w{3} [ :[:digit:]]{11} [-._[:alnum:]]+
  # PROCNAME_SMTPD=postfix/smtpd\[[[:digit:]]+\]
  # QUEUEID=(NOQUEUE|[[:upper:][:digit:]]+)
  # IP=([:digit:]{1,3}\.){3}[:digit:]{1,3}

  @LEAD@ @PROCNAME_SMTPD@: $QUEUEID@: reject: RCPT from @HOSTNAME@\[@IP@\] ...

Then, it would also make sense to define a default LEAD, or default
matches for IP addresses and hostnames etc, which can be overridden.
#376106#6
Date:
2006-06-30 10:53:35 UTC
From:
To:
Please find attached a reference implementation of this feature,
using make.
#376106#9
Date:
2006-06-30 11:51:57 UTC
From:
To:
This approach also allows command interpolation:

  #: HOSTNAME   = `hostname`

Which will make sure that log messages match the local host.