<table cellspacing="0" cellpadding="0" border="0" ><tr><td valign="top" style="font: inherit;"><DIV>Hi Martin & Florian,</DIV>
<DIV> </DIV>
<DIV>I am not good at SQL and I have the following table right now. Do you mean my current table also needs to merge with your table to form one single table? </DIV>
<DIV> </DIV>
<DIV>What is the corresponding syslog-ng.conf file which I should modify to fit for your table?</DIV>
<DIV> </DIV>
<DIV>Once again, thanks for your suggestions for me.</DIV>
<DIV> </DIV>
<DIV>mysql> desc logs;<BR>+----------+------------------+------+-----+---------+----------------+<BR>| Field | Type | Null | Key | Default | Extra |<BR>+----------+------------------+------+-----+---------+----------------+<BR>| host | varchar(32) | YES | MUL | NULL | |<BR>| facility | varchar(10) | YES | MUL | NULL | |<BR>| priority | varchar(10) | YES | MUL | NULL
| |<BR>| level | varchar(10) | YES | | NULL | |<BR>| tag | varchar(10) | YES | | NULL | |<BR>| date | date | YES | MUL | NULL | |<BR>| time | time | YES | MUL |
NULL | |<BR>| program | varchar(15) | YES | MUL | NULL | |<BR>| msg | text | YES | | NULL | |<BR>| seq | int(10) unsigned | NO | PRI | NULL | auto_increment |<BR>+----------+------------------+------+-----+---------+----------------+<BR>10 rows in set (0.00 sec)<BR><BR><BR>Regards,<BR>Marcos<BR><BR>--- On <B>Fri, 8/19/11, Martin Holste <I><mcholste@gmail.com></I></B> wrote:<BR></DIV>
<BLOCKQUOTE style="PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: rgb(16,16,255) 2px solid"><BR>From: Martin Holste <mcholste@gmail.com><BR>Subject: Re: [syslog-ng] Store syslog occurrence frequency instead of adding all of them to the DB<BR>To: "Syslog-ng users' and developers' mailing list" <syslog-ng@lists.balabit.hu><BR>Cc: "Marcos Tang" <marcostang2002@yahoo.com><BR>Date: Friday, August 19, 2011, 4:10 AM<BR><BR>
<DIV class=plainMail>I'd add on to this by using a crc function to hash the message and<BR>store that in a column to make the unique check very fast:<BR>CREATE TABLE mylogs (<BR> id BIGINT UNSIGNED NOT NULL PRIMARY KEY AUTO_INCREMENT,<BR> timestamp TIMESTAMP NOT NULL,<BR> crc INT UNSIGNED NOT NULL,<BR> count INT UNSIGNED NOT NULL DEFAULT 0,<BR> msg TEXT,<BR> UNIQUE KEY (crc)<BR>);<BR>INSERT INTO mylogs (timestamp, crc, msg) values($timestamp, CRC32($msg),<BR>$msg) ON DUPLICATE KEY UPDATE count=count+1, timestamp=$timestamp;<BR><BR>On Thu, Aug 18, 2011 at 1:33 PM, <A href="http://us.mc1121.mail.yahoo.com/mc/compose?to=system@ra-schaal.de" ymailto="mailto:system@ra-schaal.de">system@ra-schaal.de</A><BR><<A href="http://us.mc1121.mail.yahoo.com/mc/compose?to=system@ra-schaal.de" ymailto="mailto:system@ra-schaal.de">system@ra-schaal.de</A>> wrote:<BR>> Am 18.08.2011 19:52, schrieb Marcos Tang:<BR>><BR>>>
Can those records being "processed" some how and when I search the MySQL<BR>>> DB, I only see ONE record list the following only?<BR>>><BR>>> Total occurrenceMessage content<BR>>> =====================<BR>>> 14,400File system is full<BR>>><BR>><BR>> canīt you use something like<BR>><BR>> INSERT INTO tables VALUES (date,logstring) ON duplicate KEY UPDATE date;<BR>><BR>> ?<BR>><BR>> florian<BR>> ______________________________________________________________________________<BR>> Member info: <A href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target=_blank>https://lists.balabit.hu/mailman/listinfo/syslog-ng</A><BR>> Documentation: <A href="http://www.balabit.com/support/documentation/?product=syslog-ng" target=_blank>http://www.balabit.com/support/documentation/?product=syslog-ng</A><BR>> FAQ: <A href="http://www.balabit.com/wiki/syslog-ng-faq"
target=_blank>http://www.balabit.com/wiki/syslog-ng-faq</A><BR>><BR>><BR></DIV></BLOCKQUOTE></td></tr></table>