Bazsi

I see your point but wouldn't it be possible to include the host info as well f.e.

date host1 xxxxxxxxxxxxxx
date host2 yyyyyyyyyyyyyy
date host3 zzzzzzzzzzzzzz
date host 1 xxxxxxxxxxxxx
date host2 message repeated n times

meaning that the last message host2 sent was repeated n times shortly after eventhough other hosts have sent stuff in the meantime as well.
Or you could include the original message ( or at least the first few characters of it) itself in the repeat message like:

host2 message "zzzzzzzzzzzzzzzzzzzzzzz" was repeated n times

just throwing out ideas

On Tue, May 27, 2008 at 9:25 AM, Balazs Scheidler <bazsi@balabit.hu> wrote:
On Mon, 2008-05-26 at 20:05 -0700, stucky wrote:
> I've been after this since I switched to ng and realized this feature
> was not migrated over (for reasons beyond me since this was the only
> good feature of syslog !)
> I'd be very interested in having this ported to the 2.x branch but I'm
> not a programmer so I need to rely on you code gurus for that.
> Nice to see that someone is on it and I'd be happy to help test it !

the problem with suppressing duplicate messages is that it loses too
much information, and once you collect messages from several devices
into the same file, the message "Last message repeated N times" does not
really have too much information. You lose:
 * host information
 * timing
 * the message itself

So analyzing this is almost impossible. I might integrate a patch that
implements this, though.

--
Bazsi

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.campin.net/syslog-ng/faq.html




--
stucky