[syslog-ng] Re: syslog and "...last message repeated..."

[Brad Arlt]

On Tue, May 23, 2000 at 12:49:54PM -0400, John A. Parker wrote:
> My question is this: Is there anyway to stop the distributed syslogd 
> daemons from aggregating messages? Having a message with the string 
> "abcd..." repeated is easy to track, no matter the sourcing system. Having 
> the same message from system "a", followed by some other messages from 
> systems "b"-"z", followed by "...last message repeated 2 times..." from 
> system "a" makes keeping track of message counts very complicated.

the "...last message repeated 2 times..." is created by the local
syslog daemon (IOW before it is sent to your loghost).  The Solaris,
IRIX, (i think) Tru64, and apparently AIX syslogd's from the respecive
vendors all do this.

Unfortunately, I can see no way to turn this form of log compression
off (under Solaris, IRIX, and AIX at least), aside from running
syslog-ng on the client side of things.

If running syslog-ng every where isn't an option, then all I can think
of is "I don't suppose AIX's syslogd is open source?"
----------------------------------------------------------------------------
   __o		Bradley Arlt	  Email: arlt@cpsc.ucalgary.ca         o__
 _ \<_				    WWW: www.acs.ucalgary.ca/~bdarlt   _>/ _
(_)/(_)  -Eat well, sleep peacefully, drink lots, and ride like hell. (_)\(_)