[syslog-ng]Re: Flood Protection

[Thomas Vögtle]

Jason Haar wrote:
> One problem with this feature is that it can only work if the last 137
> syslog events to occur were the same event. We run a large centralized
> syslog server environment, with lots of syslog clients, and as such this
> sort of limiting feature never really gets to work, as it's quite rare
> for one event to occur record after record without some other client
> squirting in a new record. 

OK, but if you run syslog-ng local, and only logging local logs, then it
is easy to fill the harddisk with logger. With a good flood protection
it is more difficult.

Greetings