Re: [syslog-ng] min and max message count condition in correlation actions

Anton Koldaev <koldaevav@gmail.com> writes:

Balabit guys: any way to force it not to drop messages by rate, but execute an action instead? (For example: execute log() if rate >= 10/60s)

I'd love to teach syslog-ng to do that, but that needs quite a bit of work, and isn't likely to happen anytime soon, I'm afraid. (Unless I'm missing something, but I find that unlikely.) -- |8]