Dear old syslogd has explicit code to save a copy of the last message received, and compare it with the current message ( less the timestamp field and it only saves 256 bytes of message(?) ), so as to throttle out such floods. It's fairly basic, however, as it imposes no time restriction on the history buffer, so duplicate messages hours apart don't cause separate messages to be logged. As far as I'm aware, syslog-ng has never had this feature, but I agree it would be highly desirable to add to future releases. On the face of it, the basic functionality provided in syslogd shouldn't be difficult thing to code. however, the tricky bells&whistles feature would be to add a separate message history/throttle/cache(?)/aging(?) for each source IP so that a server could correctly spot multiple copies of the same message within a given timeframe even if intervening messages were from a different source. Ted -----Original Message----- From: Chuck Berg <chuck@encinc.com>@FLEXTECH Sent: Wednesday 02 July 2003 21:53 To: syslog-ng@lists.balabit.hu Subject: [syslog-ng]last message repeated? Is there a particular reason why syslog-ng doesn't generate "last message repeated x times" messages? It's very unfortunate to have the disk on my log server fill up because of one machine flooding the logs. For example, Solaris will send one "WARNING: /tmp: File system full, swap space limit exceeded" message for every write() that fails for that reason. It's easy to get tens of thousands of these per second. _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************