RE: [syslog-ng] prune identical messages
I would prefer the message suppressed if possible as it gives more information, sorry for not being specific. So is it possible to have the suppressed message. As I have not seen any such option? Richard -----Original Message----- From: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu]On Behalf Of Valdis.Kletnieks@vt.edu Sent: March 27, 2006 4:42 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] prune identical messages On Mon, 27 Mar 2006 15:26:41 EST, Richard Legault said:
But the message repeating does not give you any new information so it is a wa ste of diskspace to store it. Because It is just as helpfull to say foo1: ssh connection from 129.257.10.4 foo1: 2,348 duplicate messages suppressed
*exactly*. But what you asked for was (your words now): "those occurring between would simply be dropped." Producing a "duplicate messages suppressed" is *not* "simply dropping". Also, notice that if you have an interleaved series of 2 or more message streams that are identical to themselves but not each other, you can get this: foo1: message 1 foo1: message 2 foo1: message 3 foo1: message 2 foo1: message 3 foo1: message 1 foo1: message 3 and so on - this requires keeping a copy of the last N messages rather than just the last single one to do it correctly. Proper choice of N to prevent being DoS'ed by an out-of-memory when flooded by a mass of non-identical messages is left as an exercise for the student....
source kernel { file("/proc/kmsg" log_prefix ("kernel: ")); }; This is the line it keeps complaining about, I'm not sure why...? I'm worth a million in prizes With my torture film Drive a GTO Wear a uniform On a government loan. __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com
On Mon, 2006-03-27 at 14:18 -0800, Andrew Meyer wrote:
source kernel { file("/proc/kmsg" log_prefix ("kernel: ")); }; This is the line it keeps complaining about, I'm not sure why...?
"kernel" is currently a reserved word, I was about to kill that, but you can work it around by using something like "s_kernel" for the name of the source. -- Bazsi
Thank you! --- Balazs Scheidler <bazsi@balabit.hu> wrote:
On Mon, 2006-03-27 at 14:18 -0800, Andrew Meyer wrote:
source kernel { file("/proc/kmsg" log_prefix ("kernel: ")); }; This is the line it keeps complaining about, I'm not sure why...?
"kernel" is currently a reserved word, I was about to kill that, but you can work it around by using something like "s_kernel" for the name of the source.
-- Bazsi
_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
I'm worth a million in prizes With my torture film Drive a GTO Wear a uniform On a government loan. __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com
Its complaining about the other lines with 'kernel' in them, do I change them to s_kernel too? --- Andrew Meyer <andrewm659@yahoo.com> wrote:
Thank you!
--- Balazs Scheidler <bazsi@balabit.hu> wrote:
On Mon, 2006-03-27 at 14:18 -0800, Andrew Meyer wrote:
source kernel { file("/proc/kmsg" log_prefix ("kernel: ")); }; This is the line it keeps complaining about, I'm not sure why...?
"kernel" is currently a reserved word, I was about to kill that, but you can work it around by using something like "s_kernel" for the name of the source.
-- Bazsi
_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu
https://lists.balabit.hu/mailman/listinfo/syslog-ng
Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
I'm worth a million in prizes With my torture film Drive a GTO Wear a uniform On a government loan.
__________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
I'm worth a million in prizes With my torture film Drive a GTO Wear a uniform On a government loan. __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com
participants (3)
-
Andrew Meyer
-
Balazs Scheidler
-
Richard Legault