<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
thanks now it's working. Note that the suppress() option is supported
by syslog-ng 2.1.1 and later<br>
<br>
Julien Lecubin<br>
<blockquote cite="mid:4A3BCAB70200006800014FF0@gwia.alliedtelesyn.co.nz"
type="cite">
<pre wrap="">One simplistic approach would be to use the 'suppress' functionality.
e.g.:
destination d_mail {
program("perl /usr/local/bin/mail_log_mailsend.pl $MSG " suppress(60) );
};
This only works if the messages were duplicates (same content from same host).
</pre>
<blockquote type="cite">
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">Julien lecubin <a class="moz-txt-link-rfc2396E" href="mailto:julien.lecubin@imcce.fr"><julien.lecubin@imcce.fr></a> 6/19/2009 4:34 AM >>>
</pre>
</blockquote>
</blockquote>
</blockquote>
<pre wrap=""><!---->hi list,
what's the best way with syslog-ng to control the number of syslog mail notifications coming from a machine ?
I'm currently using perl script to send notification but sometime it just floods my mail (some 600 mails in 5 minutes for a single event)
I want to rate limit it to only 1 mail in 5 minute per host or message.
/etc/syslog-ng/syslog-ng.conf :
-----------------------------
[...]
destination d_mail {
program("perl /usr/local/bin/mail_log_mailsend.pl $MSG ");
};
[...]
filter f_notify_by_mail {level(emerg,alert,crit); };
[...]
log { source(s_network); filter(f_notify_by_mail); destination(d_mail);};
mail_log_sendmail.pl
--------------------
use MIME::Lite;
while (<>)
{
# $_ contains the Log
my $body = "Mail from Syslog-ng $_ ";
my $msg = MIME::Lite->new (
From =>'<a class="moz-txt-link-abbreviated" href="mailto:syslog-ng@my_domain.fr">syslog-ng@my_domain.fr</a>',
To =>'<a class="moz-txt-link-abbreviated" href="mailto:service.informatique@my_domain.fr">service.informatique@my_domain.fr</a>',
Subject =>'[SYSLOG-NG] Avertissement',
Type =>'multipart/related');
$msg -> attach (Type => 'text/html',
Data => qq {$body});
MIME::Lite->send('smtp','imap', Timeout=>60);
$msg -> send or die "Impossible to send mail!";
}
Is there's a notification_interval control (as i use in nagios) i can add in my syslog config file ? I didn't found anything in the man page (maybe i'm reading like a frog)
Anyone have any clues / examples to show ?
tks,
julien Lecubin
</pre>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="72">--
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Julien LECUBIN
Institut de Mecanique Celeste et de Calcul des Ephemerides
CNRS UMR 8028 - Observatoire de Paris
77, avenue Denfert Rochereau
75014 PARIS
tel : 01.40.51.22.80
fax : 01.46.33.28.34
<a class="moz-txt-link-abbreviated" href="mailto:julien.lecubin@imcce.fr">julien.lecubin@imcce.fr</a> | <a class="moz-txt-link-abbreviated" href="mailto:service.informatique@imcce.fr">service.informatique@imcce.fr</a>
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
</pre>
</body>
</html>