[syslog-ng]Avoid multiple, repeated Logmessage flooding ?
Michael Arndt
syslog-ng@lists.balabit.hu
Thu, 22 Apr 2004 14:11:40 +0200
Hello *
is there any practicable solution with syslog-ng to avoid the
following problem:
40 hosts have the same problem and flood the central loghost with
the identical, many times repeated message
to avoid this ideally one would need an equivalent to :
"last message repeated n times"
Questions: is there any possibility on the receiver (central loghost)
to filter or drop multiple identical messages ?
E.g. each hosts entry enters a centarl log only once or n times ?
On sender side a ringbuffer filter perl script could be
a solution: ringbuffer flushes identical messages in buffer
and forwards it only one time for each count of messages.
Has anyone more efficient solutions ?
thanks
Micha