- Use egrep to develop/debug rule files using logcheck mails. You can add multiple -f options to a single command invocation (it would be nice to have a mode to run logcheck over stdout)
- The best way to test a new regex is to use it in the same style as logheck it does. sed -e 's/[space]*$//' /path/to/logfile | egrep '<your filter line here>'