[syslog-ng] prune identical messages

[Valdis.Kletnieks at vt.edu]

On Mon, 27 Mar 2006 14:25:51 EST, Richard Legault said:
> How can I prevent a log from being written that is identical to the log message
> that immediately preceded it. I would like to throttle those messages so that
> they can only be printed once every 10 minutes, those occurring between would
> simply be dropped.

You *don't* want to simply drop them.

For instance, there's a *big* difference between:

foo1: ssh connection from 129.257.10.4

and 

foo1: ssh connection from 129.257.10.4
foo1: 2,348 duplicate messages suppressed

Similarly, how would your response differ for:

frobozz13: Correctable ECC error detected on board 4, SIMM 7.

and

frobozz13: Correctable ECC error detected on board 4, SIMM 7.
frobozz13: 1,438,598 duplicate messages suppressed
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
Url : http://lists.balabit.hu/pipermail/syslog-ng/attachments/20060327/9ef3bce0/attachment.pgp