<div>Rich,</div>
<div> </div>
<div>Syslog compression (i.e. the "-c" switch in other flavors of syslogd) is the one feature not available in syslog-ng that is available in other versions of syslogd. My understand is this feature might be added in a future release.
</div>
<div> </div>
<div>The other responses to this thread are saying that turning on syslog compression removes the volume component from your log which is important for determining security or IT relevance of an event.</div>
<div> </div>
<div>In some environments, admins are forced to enable compression because certain systems are verbose (e.g. forwarding firewall/VPN traffic logs, kerberos ticketing environments, etc.). </div>
<div> </div>
<div>Consider an approach where you rewrite the raw logs to a summarized version that does aggregation to preserve the volume/frequency data. For example, each day after log rotation, run a Perl script to rewrite the log.
</div>
<div> </div>
<div>Tom</div>
<div> </div>
<div><br> </div>
<div><span class="gmail_quote">On 3/27/06, <b class="gmail_sendername">Richard Legault</b> <<a href="mailto:rlegault@sandvine.com">rlegault@sandvine.com</a>> wrote:</span>
<blockquote class="gmail_quote" style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid">How can I prevent a log from being written that is identical to the log message that immediately preceded it.
<br>I would like to throttle those messages so that they can only be printed once every 10 minutes, those occurring between would simply be dropped.<br><br>Richard Legault<br>Senior Engineer<br>519-880-2400 ext 2722<br><a href="http://www.sandvine.com">
www.sandvine.com</a><br><br><br>_______________________________________________<br>syslog-ng maillist - <a href="mailto:syslog-ng@lists.balabit.hu">syslog-ng@lists.balabit.hu</a><br><a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">
https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>Frequently asked questions at <a href="http://www.campin.net/syslog-ng/faq.html">http://www.campin.net/syslog-ng/faq.html</a><br><br></blockquote></div><br>