logcheck-test(1)

💖 logcheck-test — the manual page, but make it cute 💖

okay bestie, gather round, because this is the logcheck-test page from the General Commands Manual and it's literally about testing your new logcheck rules without losing your entire mind. no cap. 🦋

---

✨ NAME ✨

logcheck-test — test new logcheck rules easily 🎀

---

🌸 SYNOPSIS 🌸

logcheck-test [-q|-i] [-a|-s|-l FILE] [-e] [-P PREFIX] [-S SUFFIX] RULE
logcheck-test [-q|-i] [-a|-s|-l FILE] -r RULEFILE

like. that's the whole vibe. two shapes, both iconic. 👑

---

💅 DESCRIPTION 💅

so basically, logcheck-test parses a log file for matching lines — and those matches are specified by either a single RULE or a whole rule file. 🍓

and here's the part that's giving main character energy: if you're using a single RULE, you can set a PREFIX and a SUFFIX so you can write new rules easily. that's the whole point. writing rules shouldn't be a whole ordeal, fr fr. ✨

---

🧚 OPTIONS 🧚

• -h, --help — show usage information 💖 (the classic. the beloved.)
• -a, --auth.log — parse /var/log/auth.log for matching lines 🔥
• -s, --syslog — parse /var/log/syslog for matching lines 🌈
• -l, --log-file FILE — parse FILE for matching lines 🦋
• -i, --invert-match — show lines that don't match the RULE or the RULEFILE 🙈 (the chaotic option. we stan.)
• -q, --quiet — suppress the rule summary at the end of output 🤫
• -e, --surround-rule — surround RULE with the standard prefix and suffix, which is exactly this:

^[[:alpha:]]{3} [ :[:digit:]]{11} [._[:alnum:]-]+ RULE$

so you don't have to type the whole thing yourself, bestie. you're welcome. 💅

• -P, --append-prefix PREFIX — append PREFIX to the rule prefix. this option can be given multiple times ✨
• -S, --prepend-suffix SUFFIX — prepend SUFFIX to the rule suffix. this option can be given multiple times ✨
• -r, --rule-file RULEFILE — use file RULEFILE for rule input 📄

---

🎀 EXAMPLES 🎀

with logcheck-test you can easily write and test new rules. like, genuinely easily. no stress. 🌸

test a single rule against /var/log/syslog:

logcheck-test -s "RULE"

test a single rule against ~/log, surround the rule with standard prefix and suffix, and append "kernel " to the prefix:

logcheck-test -l ~/log -e -P "kernel " "RULE"

test the rules in rulefiles/linux/ignore.d.server/kernel against ~/log:

logcheck-test -l ~/log -r rulefiles/linux/ignore.d.server/kernel

test which lines the rules in rulefiles/linux/ignore.d.server/kernel doesn't match:

logcheck-test -l ~/log -r rulefiles/linux/ignore.d.server/kernel -i

---

⭐ EXIT STATUS ⭐

• on successful matching, logcheck-test will complete with exit code 0. slay. ✅
• an exit code of 1 indicates no successful matching. 😭
• an exit code greater then 1 indicates an error occurred. textual errors are written to the standard error stream. 💀

not me caring deeply about your exit codes but like… please check them. iykyk.

---

🫶 SEE ALSO 🫶

• logcheck(8)

---

👑 AUTHOR 👑

logcheck is developed by the Debian logcheck Team at: https://salsa.debian.org/debian/logcheck

this manual was written by Hannes von Haugwitz <hannes@vonhaugwitz.com>. absolute icon. 💜

---

and that's the whole page, bestie!! this one's from the General Commands Manual, and the footer said Feb 19, 2010 — so yeah, this manual has been out here being useful since 2010 and it's still serving. go write some rules. periodt. 💖✨🎀🦋