I was looking at the manpage for rsyslog.conf, primarily because I need to filter my manager's new fedora 22 logs coming to our loghost, because of the bug that I forwarded (if it gets through).
At any rate, I am surprised: under selectors, I see that " The keywords error, warn and panic are deprecated and should not be used anymore."
Huh?
If I only want warn or more severe, how am I supposed to filter - write a much more elaborate RE?
mark
Looking at the same manpage, it seems that these selectors are not really being removed, just renamed. The old names are being deprecated.
Instead of Use ========== === warn warning err error panic emerg
Best regards
Dave Windsor AdP/TEF7
-----Original Message----- From: centos-bounces@centos.org [mailto:centos-bounces@centos.org] On Behalf Of m.roth@5-cent.us Sent: Wednesday, July 22, 2015 11:07 AM To: CentOS Subject: [CentOS] rsyslog.conf
I was looking at the manpage for rsyslog.conf, primarily because I need to filter my manager's new fedora 22 logs coming to our loghost, because of the bug that I forwarded (if it gets through).
At any rate, I am surprised: under selectors, I see that " The keywords error, warn and panic are deprecated and should not be used anymore."
Huh?
If I only want warn or more severe, how am I supposed to filter - write a much more elaborate RE?
mark
_______________________________________________ CentOS mailing list CentOS@centos.org http://lists.centos.org/mailman/listinfo/centos
Windsor Dave (AdP/TEF7) wrote:
Looking at the same manpage, it seems that these selectors are not really being removed, just renamed. The old names are being deprecated.
Instead of Use ========== === warn warning err error panic emerg
Thanks. I didn't see that.
Unfortunately, it still didn't solve the problem (my manager's newly-upgraded fedora from 20->22, and according to the bugzilla bug, the systemd developers want *all* logs, and they're dumping *everything* from auditd, all successes by root jobs, cron, everything - fine, I suppose, for someone debugging systemd....)
mark
Best regards
Dave Windsor AdP/TEF7
-----Original Message----- From: centos-bounces@centos.org [mailto:centos-bounces@centos.org] On Behalf Of m.roth@5-cent.us Sent: Wednesday, July 22, 2015 11:07 AM To: CentOS Subject: [CentOS] rsyslog.conf
I was looking at the manpage for rsyslog.conf, primarily because I need to filter my manager's new fedora 22 logs coming to our loghost, because of the bug that I forwarded (if it gets through).
At any rate, I am surprised: under selectors, I see that " The keywords error, warn and panic are deprecated and should not be used anymore."
Huh?
If I only want warn or more severe, how am I supposed to filter - write a much more elaborate RE?
mark
CentOS mailing list CentOS@centos.org http://lists.centos.org/mailman/listinfo/centos _______________________________________________ CentOS mailing list CentOS@centos.org http://lists.centos.org/mailman/listinfo/centos
Sorry for the top post, Outlook defaults strike again.....
Best regards
Dave Windsor AdP/TEF7
Am 22.07.2015 um 17:41 schrieb Windsor Dave (AdP/TEF7) Dave.Windsor@us.bosch.com:
Sorry for the top post, Outlook defaults strike again.....
Outlook forces you to write above ? :-)
-- LF
-----Original Message----- From: centos-bounces@centos.org [mailto:centos-bounces@centos.org] On Behalf Of Leon Fauster Sent: Wednesday, July 22, 2015 6:20 PM To: CentOS mailing list Subject: Re: [CentOS] rsyslog.conf
Am 22.07.2015 um 17:41 schrieb Windsor Dave (AdP/TEF7) Dave.Windsor@us.bosch.com:
Sorry for the top post, Outlook defaults strike again.....
Outlook forces you to write above ? :-)
-- LF
Perhaps I should say instead that it "strongly encourages" top posting, and all our internal emails follow that convention.
It's habit-forming.... :-)
Best regards
Dave Windsor AdP/TEF7
Windsor Dave (AdP/TEF7) wrote:
Behalf Of Leon Fauster Am 22.07.2015 um 17:41 schrieb Windsor Dave (AdP/TEF7) Dave.Windsor@us.bosch.com:
Sorry for the top post, Outlook defaults strike again.....
Outlook forces you to write above ? :-)
Perhaps I should say instead that it "strongly encourages" top posting, and all our internal emails follow that convention.
It's habit-forming.... :-)
Best regards
Yeah, and it's an M$ innovation I *really* dislike. I've had disagreements with my wife about that. What was it, Lookout, er Outlook '08 that did that?
The *real* issue is that the way email traditionally was, with bottom posting, or intercollation, made it *readable*, and esp. if you come into a thread late, you could figure out what was going on.
I don't know of any written language on the planet that reads from the bottom up... and if *anyone* doesn't top post, like a lot of us, it makes it unreadable (up, down, up, down, down, up....)... which is why the generally-agreed convention on every mailing list I'm on is traditional format.
mark "Kill Bill...."
On Thu, July 23, 2015 9:31 am, m.roth@5-cent.us wrote:
Windsor Dave (AdP/TEF7) wrote:
Behalf Of Leon Fauster Am 22.07.2015 um 17:41 schrieb Windsor Dave (AdP/TEF7) Dave.Windsor@us.bosch.com:
Sorry for the top post, Outlook defaults strike again.....
Outlook forces you to write above ? :-)
Perhaps I should say instead that it "strongly encourages" top posting,
and all our internal emails follow that convention.
It's habit-forming.... :-) Best regards
Yeah, and it's an M$ innovation I *really* dislike. I've had
disagreements
with my wife about that. What was it, Lookout, er Outlook '08 that did
that?
The *real* issue is that the way email traditionally was, with bottom
posting, or intercollation, made it *readable*, and esp. if you come into
a thread late, you could figure out what was going on.
"Come to the thread late" argument is the only rationale for "no top posting" in case of mail lists I can figure myself. Plus to have all messages in some standard format.
I hope, the following will make piece between you and your wife. In regular e-mail exchange both parties are constantly "in sync", thus understand what previous statements this particular message deals with. Therefore I personally find it advantageous in private exchange to have new information - i.e. message I'm writing - be right at the top of current e-mail. This is my current message I want my recipient to read (but the rest of exchange is after it as well for recipient's convenience). I can say many bad words about Microsoft, but this rationale for private mail exchange is something I will not blame them about.
So far I collected two arguments to not "top post" on mail lists:
1. standardized format of all messages with answers (like the whole thread in front of your eyes, and it is always in the same format)
2. easier reading for "new comers" to the thread: in chronological order.
Any others rationales?
Valeri
I don't know of any written language on the planet that reads from the
bottom up... and if *anyone* doesn't top post, like a lot of us, it makes
it unreadable (up, down, up, down, down, up....)... which is why the
generally-agreed convention on every mailing list I'm on is traditional format.
mark "Kill Bill...."
CentOS mailing list CentOS@centos.org http://lists.centos.org/mailman/listinfo/centos
++++++++++++++++++++++++++++++++++++++++ Valeri Galtsev Sr System Administrator Department of Astronomy and Astrophysics Kavli Institute for Cosmological Physics University of Chicago Phone: 773-702-4247 ++++++++++++++++++++++++++++++++++++++++
Physically dragging the thread back on topic...
I really am going crazy, trying to deal with the hourly logs from the loghost. We've got 170+ servers and workstations... but a *very* large percentage of what's showing up is from his bloody new fedora 22, with its idiot systemd logging of *ever* selinux message to /var/log/messages.
I tried creating a rule, /etc/rsyslog.d/audit.conf, that reads:
if $msg contains "audit" and $msg,contains,'res=success' then -
but that seemed to send *everything* to /dev/null. That was my best guess, based on googling (yahooing?) and man pages. Can anyone tell me what's wrong with that syntax?
mark
On Thu, Jul 23, 2015 at 01:19:44PM -0400, m.roth@5-cent.us wrote:
I really am going crazy, trying to deal with the hourly logs from the loghost. We've got 170+ servers and workstations... but a *very* large percentage of what's showing up is from his bloody new fedora 22, with its idiot systemd logging of *ever* selinux message to /var/log/messages.
systemctl enable auditd systemctl start auditd
Now your SELinux (and other audit) logs are going to /var/log/audit/audit.log.
Jonathan Billings wrote:
On Thu, Jul 23, 2015 at 01:19:44PM -0400, m.roth@5-cent.us wrote:
I really am going crazy, trying to deal with the hourly logs from the loghost. We've got 170+ servers and workstations... but a *very* large percentage of what's showing up is from his bloody new fedora 22, with its idiot systemd logging of *ever* selinux message to /var/log/messages.
systemctl enable auditd systemctl start auditd
Now your SELinux (and other audit) logs are going to /var/log/audit/audit.log.
Um, no. That was where I started this thread - my manager updated his fedora box from 20 to 22, and there's a bug about it https://bugzilla.redhat.com/show_bug.cgi?id=1227379, where it appears that the systemd folks have demanded *all* logs, and are multicast spitting out the selinux logs *als0* to /var/log/messages.
And I just checked, and yes, auditd is running.
So I'm back to trying to find the correct syntax to filter all the successes seen by auditd from getting to messages....
mark
On Thu, Jul 23, 2015 at 2:17 PM, m.roth@5-cent.us wrote:
There's ~4 aspects to that bug so it's just going to have to settle out, with the main one being comment 25 where systemd-journald is enabling audit and inappropriately mixing data with different discretion levels.
On Thu, July 23, 2015 8:43 am, Windsor Dave (AdP/TEF7) wrote:
-----Original Message----- From: centos-bounces@centos.org [mailto:centos-bounces@centos.org] On Behalf Of Leon Fauster Sent: Wednesday, July 22, 2015 6:20 PM To: CentOS mailing list Subject: Re: [CentOS] rsyslog.conf
Am 22.07.2015 um 17:41 schrieb Windsor Dave (AdP/TEF7) Dave.Windsor@us.bosch.com:
Sorry for the top post, Outlook defaults strike again.....
Outlook forces you to write above ? :-)
-- LF
Perhaps I should say instead that it "strongly encourages" top posting, and all our internal emails follow that convention.
It's habit-forming.... :-)
Well, my habit for regular e-mail exchange is "top posting" thus the person reads my message thus is right to the point why this particular message message was sent in a first place... But when mail lists are concerned, I do an opposite, that is I follow mail lists conventions. I never thought about rationale behind them, I'm just following them. I believe, if some day someone gives reasons why top posting is bad in case of mail lists it will really be great. The only reason I can come up with myself would be: whoever reads message received through mail lists usually has no idea about previous exchange in this thread, thus needs all exchange in chronological order. Which I'm not certain is a good reason, so those who know and insists strongly about "no top posting" are encouraged to give others the reasons behind that. Again, I'm not "top posting" on the lists. However, _this_ ("top posting") is my regular way in private exchange (and it has good reasons behind it).
Valeri
++++++++++++++++++++++++++++++++++++++++ Valeri Galtsev Sr System Administrator Department of Astronomy and Astrophysics Kavli Institute for Cosmological Physics University of Chicago Phone: 773-702-4247 ++++++++++++++++++++++++++++++++++++++++
Am 23.07.2015 um 16:34 schrieb Valeri Galtsev galtsev@kicp.uchicago.edu:
On Thu, July 23, 2015 8:43 am, Windsor Dave (AdP/TEF7) wrote:
Perhaps I should say instead that it "strongly encourages" top posting, and all our internal emails follow that convention.
It's habit-forming.... :-)
Well, my habit for regular e-mail exchange is "top posting" thus the person reads my message thus is right to the point why this particular message message was sent in a first place... But when mail lists are concerned, I do an opposite, that is I follow mail lists conventions. I never thought about rationale behind them, I'm just following them. I believe, if some day someone gives reasons why top posting is bad in case of mail lists it will really be great. The only reason I can come up with myself would be: whoever reads message received through mail lists usually has no idea about previous exchange in this thread, thus needs all exchange in chronological order. Which I'm not certain is a good reason, so those who know and insists strongly about "no top posting" are encouraged to give others the reasons behind that. Again, I'm not "top posting" on the lists. However, _this_ ("top posting") is my regular way in private exchange (and it has good reasons behind it).
well, as you wrote: ... because in conventional spelling systems of western languages, text is written from the top to the bottom (applies also for reading). To rephrase it: the "usability" is higher while reading bottom posted messages. Furthermore stripping is normally done more (footers, disclaimers etc. disappears) when bottom posted. This cleans the context additionally ...
The problem gets worse when both styles are mixed. Try to read a correspondence from a year ago in such a style. Its horrible ...
:-)
-- LF
On 07/23/2015 09:34 AM, Valeri Galtsev wrote:
On Thu, July 23, 2015 8:43 am, Windsor Dave (AdP/TEF7) wrote:
-----Original Message-----
<snip>
Sorry for the top post, Outlook defaults strike again.....
Outlook forces you to write above ? :-)
<snip>
Perhaps I should say instead that it "strongly encourages" top posting, and all our internal emails follow that convention.
It's habit-forming.... :-)
Well, my habit for regular e-mail exchange is "top posting" thus the person reads my message thus is right to the point why this particular message message was sent in a first place... But when mail lists are concerned, I do an opposite, that is I follow mail lists conventions. I never thought about rationale behind them, I'm just following them. I believe, if some day someone gives reasons why top posting is bad in case of mail lists it will really be great. The only reason I can come up with myself would be: whoever reads message received through mail lists usually has no idea about previous exchange in this thread, thus needs all exchange in chronological order. Which I'm not certain is a good reason, so those who know and insists strongly about "no top posting" are encouraged to give others the reasons behind that. Again, I'm not "top posting" on the lists. However, _this_ ("top posting") is my regular way in private exchange (and it has good reasons behind it).
The main reason actually is chronological order. But not just for the reply .. but for IN-LINE posting.
In a discussion where you need to make points in-line and where you only need some of and not all of the other posts, something that happens frequently on mailing lists, it is very much easier to read that type of collaborated message in chronological order.
I mean, you don't read a book or a newspaper article or a blog post from bottom to top, right? Why would you read communications from bottom to top? And it is not really even bottom to top. If you take 4 emails of 10 lines each (and 40 lines total) .. it is 75% down to 100% (original mail)... then up to 50% and read down to 75% (2nd mail), then up to 25% and read down to 50%, then up to 0% and read down to 25%. What if someone made you read blog posts that way, or books or newspaper articles?
On Thu, July 23, 2015 10:45 am, Johnny Hughes wrote:
On 07/23/2015 09:34 AM, Valeri Galtsev wrote:
On Thu, July 23, 2015 8:43 am, Windsor Dave (AdP/TEF7) wrote:
-----Original Message-----
<snip> >>>> Sorry for the top post, Outlook defaults strike again..... >>> >>> Outlook forces you to write above ? :-) <snip> >> >> Perhaps I should say instead that it "strongly encourages" top posting, >> and all our internal emails follow that convention. >> >> It's habit-forming.... :-) > > Well, my habit for regular e-mail exchange is "top posting" thus the > person reads my message thus is right to the point why this particular > message message was sent in a first place... But when mail lists are > concerned, I do an opposite, that is I follow mail lists conventions. I > never thought about rationale behind them, I'm just following them. I > believe, if some day someone gives reasons why top posting is bad in > case > of mail lists it will really be great. The only reason I can come up > with > myself would be: whoever reads message received through mail lists > usually > has no idea about previous exchange in this thread, thus needs all > exchange in chronological order. Which I'm not certain is a good reason, > so those who know and insists strongly about "no top posting" are > encouraged to give others the reasons behind that. Again, I'm not "top > posting" on the lists. However, _this_ ("top posting") is my regular way > in private exchange (and it has good reasons behind it).
The main reason actually is chronological order. But not just for the reply .. but for IN-LINE posting.
In a discussion where you need to make points in-line and where you only need some of and not all of the other posts, something that happens frequently on mailing lists, it is very much easier to read that type of collaborated message in chronological order.
I mean, you don't read a book or a newspaper article or a blog post from bottom to top, right? Why would you read communications from bottom to top? And it is not really even bottom to top. If you take 4 emails of 10 lines each (and 40 lines total) .. it is 75% down to 100% (original mail)... then up to 50% and read down to 75% (2nd mail), then up to 25% and read down to 50%, then up to 0% and read down to 25%. What if someone made you read blog posts that way, or books or newspaper articles?
OK, the shortest I can re-formulate your message is: on mail lists we are collectively writing the book for someone else to read (much less communicating with each other in real time ;-) Any accepted convention is better than no convention: save everybody's time. Suits me (as far as mail lists are concerned).
Valeri
++++++++++++++++++++++++++++++++++++++++ Valeri Galtsev Sr System Administrator Department of Astronomy and Astrophysics Kavli Institute for Cosmological Physics University of Chicago Phone: 773-702-4247 ++++++++++++++++++++++++++++++++++++++++
Am 23.07.2015 um 18:06 schrieb "Valeri Galtsev" galtsev@kicp.uchicago.edu:
On Thu, July 23, 2015 10:45 am, Johnny Hughes wrote:
The main reason actually is chronological order. But not just for the reply .. but for IN-LINE posting.
In a discussion where you need to make points in-line and where you only need some of and not all of the other posts, something that happens frequently on mailing lists, it is very much easier to read that type of collaborated message in chronological order.
I mean, you don't read a book or a newspaper article or a blog post from bottom to top, right? Why would you read communications from bottom to top? And it is not really even bottom to top. If you take 4 emails of 10 lines each (and 40 lines total) .. it is 75% down to 100% (original mail)... then up to 50% and read down to 75% (2nd mail), then up to 25% and read down to 50%, then up to 0% and read down to 25%. What if someone made you read blog posts that way, or books or newspaper articles?
OK, the shortest I can re-formulate your message is: on mail lists we are collectively writing the book for someone else to read (much less communicating with each other in real time ;-) Any accepted convention is better than no convention: save everybody's time. Suits me (as far as mail lists are concerned).
I consider email as an asynchronous communication, therefore "book style convention" is recommended.
-- LF
Leon Fauster wrote:
Am 23.07.2015 um 18:06 schrieb "Valeri Galtsev" galtsev@kicp.uchicago.edu:
On Thu, July 23, 2015 10:45 am, Johnny Hughes wrote:
The main reason actually is chronological order. But not just for the reply .. but for IN-LINE posting.
In a discussion where you need to make points in-line and where you only need some of and not all of the other posts, something that happens frequently on mailing lists, it is very much easier to read that type of collaborated message in chronological order.
I mean, you don't read a book or a newspaper article or a blog post from bottom to top, right? Why would you read communications from bottom to top? And it is not really even bottom to top. If you take 4 emails of 10 lines each (and 40 lines total) .. it is 75% down to 100% (original mail)... then up to 50% and read down to 75% (2nd mail), then up to 25% and read down to 50%, then up to 0% and read down to 25%. What if someone made you read blog posts that way, or books or newspaper articles?
OK, the shortest I can re-formulate your message is: on mail lists we are collectively writing the book for someone else to read (much less communicating with each other in real time ;-) Any accepted convention is better than no convention: save everybody's time. Suits me (as far as mail lists are concerned).
I consider email as an asynchronous communication, therefore "book style convention" is recommended.
Yup. We're writing electronic *mail*, not text messages (here, you've got 140 char, tell me everything you know....), and you don't have a two-line pager screen.... I see it as a slo-mo group conversation, and top-posting is like the person who suddenly utters a nonsequitur, louder than everyone else is speaking....
mark
On 7/23/2015 12:15 PM, m.roth@5-cent.us wrote:
Leon Fauster wrote:
Am 23.07.2015 um 18:06 schrieb "Valeri Galtsev" galtsev@kicp.uchicago.edu:
On Thu, July 23, 2015 10:45 am, Johnny Hughes wrote:
The main reason actually is chronological order. But not just for the reply .. but for IN-LINE posting.
In a discussion where you need to make points in-line and where you only need some of and not all of the other posts, something that happens frequently on mailing lists, it is very much easier to read that type of collaborated message in chronological order.
I mean, you don't read a book or a newspaper article or a blog post from bottom to top, right? Why would you read communications from bottom to top? And it is not really even bottom to top. If you take 4 emails of 10 lines each (and 40 lines total) .. it is 75% down to 100% (original mail)... then up to 50% and read down to 75% (2nd mail), then up to 25% and read down to 50%, then up to 0% and read down to 25%. What if someone made you read blog posts that way, or books or newspaper articles?
OK, the shortest I can re-formulate your message is: on mail lists we are collectively writing the book for someone else to read (much less communicating with each other in real time ;-) Any accepted convention is better than no convention: save everybody's time. Suits me (as far as mail lists are concerned).
I consider email as an asynchronous communication, therefore "book style convention" is recommended.
Yup. We're writing electronic *mail*, not text messages (here, you've got 140 char, tell me everything you know....), and you don't have a two-line pager screen.... I see it as a slo-mo group conversation, and top-posting is like the person who suddenly utters a nonsequitur, louder than everyone else is speaking....
mark
CentOS mailing list CentOS@centos.org http://lists.centos.org/mailman/listinfo/centos
Add to the above that on every phone I've ever used, new texts appear below older ones (no top posting there either).
-chuck
What’s even more irritating to me than top posting is when someone replies to a message that takes two page scrolls to get to the bottom then there’s only a few words that are unrelated to the actual message! What’s worse, top posting or no snipping?
-wes
On 07/30/2015 10:24 AM, Wes James wrote:
What’s even more irritating to me than top posting is when someone replies to a message that takes two page scrolls to get to the bottom then there’s only a few words that are unrelated to the actual message! What’s worse, top posting or no snipping?
No snipping with bottom posting is worse than any top posting, IMHO. It wastes space and time and is equally bad in digests. But you're not likely to get the worst offenders to change.
Lamar Owen wrote:
On 07/30/2015 10:24 AM, Wes James wrote:
What’s even more irritating to me than top posting is when someone replies to a message that takes two page scrolls to get to the bottom then there’s only a few words that are unrelated to the actual message! What’s worse, top posting or no snipping?
No snipping with bottom posting is worse than any top posting, IMHO. It wastes space and time and is equally bad in digests. But you're not likely to get the worst offenders to change.
I don't think worse, but it's *extremely* annoying. I will also note that I see that *all* the bloody time on the selinux list, long, long posts, and a two line cmt at the end.
mark
On 7/30/2015 8:13 AM, Lamar Owen wrote:
No snipping with bottom posting is worse than any top posting, IMHO. It wastes space and time and is equally bad in digests. But you're not likely to get the worst offenders to change.
totally concur but as long as people are going to use cell phones as mobile computer substitutes, and considering how painful text editing on a touchscreen is, I doubt we'll get people to change.
On Thu, Jul 30, 2015 at 10:48:51AM -0700, John R Pierce wrote:
On 7/30/2015 8:13 AM, Lamar Owen wrote:
No snipping with bottom posting is worse than any top posting, IMHO. It wastes space and time and is equally bad in digests. But you're not likely to get the worst offenders to change.
totally concur but as long as people are going to use cell phones as mobile computer substitutes, and considering how painful text editing on a touchscreen is, I doubt we'll get people to change.
getting people to change BEFORE the advent of the tiny displays didn't work very well either, so I suspect trying to change 'em now isn't going to work well, at all.
-
Chris Murphy -
Chuck Campbell -
Fred Smith -
John R Pierce -
Johnny Hughes -
Jonathan Billings -
Lamar Owen -
Leon Fauster -
m.roth＠5-cent.us -
Valeri Galtsev -
Wes James -
Windsor Dave (AdP/TEF7)