[syslog-ng]Flood Protection

Jason Haar syslog-ng@lists.balabit.hu
Wed, 19 Nov 2003 11:09:44 +1300


On Wed, 2003-11-19 at 04:02, Thomas Vögtle wrote:
> I want to have the same as that:
> Nov 18 15:58:56 tv2 user: allwaysthesame
> Nov 18 15:58:56 tv2 last message repeated 137 times
> 

One problem with this feature is that it can only work if the last 137
syslog events to occur were the same event. We run a large centralized
syslog server environment, with lots of syslog clients, and as such this
sort of limiting feature never really gets to work, as it's quite rare
for one event to occur record after record without some other client
squirting in a new record. 

Oh well...

Cheers

Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1