<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#0050d0">
Sent: Fri Aug 19 2011 10:57:57 GMT-0600 (MST)<br>
From: Jakub Jankowski <a class="moz-txt-link-rfc2396E" href="mailto:shasta@toxcorp.com"><shasta@toxcorp.com></a><br>
To: Syslog-ng users' and developers' mailing list
<a class="moz-txt-link-rfc2396E" href="mailto:syslog-ng@lists.balabit.hu"><syslog-ng@lists.balabit.hu></a> <br>
Subject: Re: [syslog-ng] Store syslog occurrence frequency instead
of adding all of them to the DB
<blockquote
cite="mid:alpine.LNX.2.00.1108191854460.11357@bluzg.slackware.pl"
type="cite">
<pre wrap="">On 2011-08-19, <a class="moz-txt-link-abbreviated" href="mailto:syslogng@feystorm.net">syslogng@feystorm.net</a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Secondly using a 32-bit checksum of the message text to determine uniqueness
is risky. It would be farily easy to end up with 2 different messages that
have the same checksum. A md5 checksum would be much better, but I dont
believe syslog-ng has a function to compute md5 sums.
</pre>
</blockquote>
<pre wrap="">
One can delegate this task to the database itself. MySQL has MD5() as well
as SHA1() built in.
</pre>
</blockquote>
Its been a while since I've had syslog-ng talk to a database
directly, but when I did, you couldnt use database functions when
storing data. You just gave syslog-ng the names of the fields, and
then the macros to stick in those fields and syslog-ng went and
assembled the query for you. Does syslog-ng let you construct the
query yourself now? If so, then yes, using the database's hashing
functions would work fine.<br>
</body>
</html>