Bug#954802: logcheck: Support mail size limits

[Noah Meyerhans]

Package: logcheck
Version: 1.3.18
Severity: normal

It's generally considered to be good practice to configure size limits on
messages at the MTA level. Logcheck should have the ability to limit the
size of its generated to comply with such limits. I'd propose that it
should be configurable via logcheck.conf (rather than trying to autodetect
it or something like that). Ideally logcheck would split the message
across multiple emails if it has more data to send, but even just
truncating the message, with a warning, is probably better than the
current behavior of generating a message that the SMTP server won't
accept.

Thanks for maintaining logcheck!

noah

-- System Information:
Debian Release: 9.12
APT prefers oldstable
APT policy: (500, 'oldstable')
Architecture: amd64 (x86_64)

Kernel: Linux 4.19.101-linode (SMP w/2 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages logcheck depends on:
ii adduser 3.115
ii cron [cron-daemon] 3.0pl1-128+deb9u1
ii exim4-daemon-light [mail-transport-agent] 4.89-2+deb9u6
ii lockfile-progs 0.1.17+b1
ii logtail 1.3.18
ii mime-construct 1.11+nmu2
ii rsyslog [system-log-daemon] 8.24.0-1

Versions of packages logcheck recommends:
ii logcheck-database 1.3.18

Versions of packages logcheck suggests:
pn syslog-summary <none>

-- Configuration Files:
/etc/logcheck/logcheck.conf [Errno 13] Permission denied: '/etc/logcheck/logcheck.conf'
/etc/logcheck/logcheck.logfiles [Errno 13] Permission denied: '/etc/logcheck/logcheck.logfiles'

-- no debconf information

[Richard Lewis]

On Mon, 23 Mar 2020 17:46:58 +0000 Noah Meyerhans <no...@debian.org> wrote:

> It's generally considered to be good practice to configure size limits on
> messages at the MTA level. Logcheck should have the ability to limit the
> size of its generated to comply with such limits. I'd propose that it
> should be configurable via logcheck.conf (rather than trying to autodetect
> it or something like that). Ideally logcheck would split the message
> across multiple emails if it has more data to send, but even just
> truncating the message, with a warning, is probably better than the
> current behavior of generating a message that the SMTP server won't
> accept.

This seems like a good idea - i dont think mime-construct has
functionality to split the mail, but we could detect very
long messages before sending and report an error - and perhaps leave
the file for local inspection.

one to consider post bookworm