Description of problem:
Request for change in behavior and documentation for abrt-watch-log.

abrt-watch-log parameters are exposed in 'ps -ef' and similar.  Unless the operator knows how abrt-watch-log works and what it does the process listed appears to be indicating some sort of problem rather than normal operation LOOKING for a problem.  Additionally, the man page documentation is so sparse as to be essentially useless, for instance, it does not describe "--".  

Specifically, in "ps -ef" this appears:

/usr/bin/abrt-watch-log -F BUG: WARNING: at WARNING: CPU: INFO: possible recursive locking detected ernel BUG at list_del corruption list_add corruption do_IRQ: stack overflow: ear stack overflow (cur: eneral protection fault nable to handle kernel ouble fault: RTNL: assertion failed eek! page_mapcount(page) went negative! adness at NETDEV WATCHDOG ysctl table check failed : nobody cared IRQ handler type mismatch Machine Check Exception: Machine check events logged divide error: bounds: coprocessor segment overrun: invalid TSS: segment not present: invalid opcode: alignment check: stack segment: fpu exception: simd exception: iret exception: /var/log/messages -- /usr/bin/abrt-dump-oops -xtD

There are problems with this .  It looks like something dreadful has happened, with an assortment of (sometimes corrupted) warning strings appearing.  It reveals what appears to be a primitive pattern matching system (that is, to match "kernel" or "Kernel" the string "ernel" is entered in -F).  The "--" which appears is not documented in the man page.

Suggested changes are:

1.  Man page: document the "--", describe what the program does with greater specificity ("watch" is ambiguous), reference other parts of abrt, eliminate the double negative in the -F description.  A naive reading of the current documentation is that every time the file expands the command will run no matter where in the file the -F string occurs.  Presumably what it actually does is only run the command once, when the string appears in the newly expanded portion of the file.

2.  put all abrt-watch-log parameters in a configuration file, so that the "-F" parameters are hidden, and all one sees with "ps" is:  abrt-watch-log -c /etc/sysconfig/abrt-watch-log.conf /var/log/messages -- /usr/bin/abrt-dump-oops -xtD, or something similar.

3.  Allow regular expressions in the configuration file.




Version-Release number of selected component (if applicable):


How reproducible:
always


Steps to Reproduce:
1. boot system
2. login
3. ps -ef | grep abrt

Actual results:


Expected results:


Additional info: