README.logcheck-database.gz says

    <packagename> ignore-files only affect the log messages that
    would have been in that package-specific report section.

My reading of that and the surrounding material* is that such ignore
files only affect matches from a similary named <packagename> file.

But this would mean that the following ignore files have no effect,
since there are no <packagename> files that trigger any warnings:
    root@debtest:/etc# find logcheck/ -name '*systemd*'
    logcheck/ignore.d.server/systemd
    logcheck/ignore.d.server/systemd-timesyncd
    logcheck/ignore.d.server/systemd-logind

Since I think those patterns are having an effect, the documentation
seems at least misleading.  The phrase "package-specific report
section" is not clear, since AFAIK there are no package-specific
report sections; the sections of the reports are based on severity
levels.

The context for this is that I wanted to supplement the rules in
ignore.d.server/systemd and was trying to figure out what an
appropriate file name to use would be.  Most of the discussion
suggested ignore.d.server/local-systemd would be a good choice, but
then I noticed the apparent claim above that these would only filter
out stuff from, e.g., violations.d/systemd.

Ross Boylan

*
    In this situation the alarm can be overruled by a
    violations.ignore rulefile named "fooserver" which filters
    "none barred".  This will _not_ affect other "Security Events"
    featuring the words "none barred"

seems explicit that the ignore file only affects matches from a
similarly named file that generates an alarm.

    this limitation reduces the number of rules
    that need to be processed.

again seems to indicate the ignore rules are only processed in some
situations.