Bazsi<br><br>I see your point but wouldn't it be possible to include the host info as well f.e.<br><br>date host1 xxxxxxxxxxxxxx<br>date host2 yyyyyyyyyyyyyy<br>date host3 zzzzzzzzzzzzzz<br>date host 1 xxxxxxxxxxxxx<br>
date host2 message repeated n times<br><br>meaning that the last message host2 sent was repeated n times shortly after eventhough other hosts have sent stuff in the meantime as well.<br>Or you could include the original message ( or at least the first few characters of it) itself in the repeat message like:<br>
<br>host2 message "zzzzzzzzzzzzzzzzzzzzzzz" was repeated n times<br><br>just throwing out ideas<br><br><div class="gmail_quote">On Tue, May 27, 2008 at 9:25 AM, Balazs Scheidler <<a href="mailto:bazsi@balabit.hu">bazsi@balabit.hu</a>> wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><div class="Ih2E3d">On Mon, 2008-05-26 at 20:05 -0700, stucky wrote:<br>
> I've been after this since I switched to ng and realized this feature<br>
> was not migrated over (for reasons beyond me since this was the only<br>
> good feature of syslog !)<br>
> I'd be very interested in having this ported to the 2.x branch but I'm<br>
> not a programmer so I need to rely on you code gurus for that.<br>
> Nice to see that someone is on it and I'd be happy to help test it !<br>
<br>
</div>the problem with suppressing duplicate messages is that it loses too<br>
much information, and once you collect messages from several devices<br>
into the same file, the message "Last message repeated N times" does not<br>
really have too much information. You lose:<br>
* host information<br>
* timing<br>
* the message itself<br>
<br>
So analyzing this is almost impossible. I might integrate a patch that<br>
implements this, though.<br>
<font color="#888888"><br>
--<br>
Bazsi<br>
</font><div><div></div><div class="Wj3C7c"><br>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.campin.net/syslog-ng/faq.html" target="_blank">http://www.campin.net/syslog-ng/faq.html</a><br>
<br>
</div></div></blockquote></div><br><br clear="all"><br>-- <br>stucky