On Sat, Jan 10, 2004 at 05:52:54PM -0500, Asif Iqbal wrote:
Ed Ravin wrote:
I recall someone pointing out last year that syslogd has a feature where it can compress a burst of messages [...]
excerpt from syslog-ng-1.6.0rc4/contrib/syslog-ng.conf.doc
filter f_postgres { not( (host("syslogdb") and facility(cron) and level(info)) or (facility(user) and level(notice) and ( match(" gethostbyaddr: ") or match("last message repeated ") ) )
If I read that correctly, it removes messages that are unwanted, including the "last message repeated" from syslogd. I'm talking about having syslog-ng recognize that a stream of messages are duplicates, and issuing a friendlier version of "last message repeated" so that the duplicates are (mostly) suppressed. I suppose if syslog-ng had a variable for the last message string, then something like this could be done in a filter?