[syslog-ng]Avoid multiple, repeated Logmessage flooding ?
   
    Michael Arndt
     
    syslog-ng@lists.balabit.hu
       
    Thu, 22 Apr 2004 14:11:40 +0200
    
    
  
Hello *
is there any practicable solution with syslog-ng to avoid the 
following problem:
40 hosts have the same problem and flood the central loghost with
the identical, many times repeated message
to avoid this ideally one would need an equivalent to :
"last message repeated n times"
Questions: is there any possibility on the receiver (central loghost)
           to filter or drop multiple identical messages ?
           E.g. each hosts entry enters a centarl log only once or n times ?
          
           On sender side  a ringbuffer filter perl script could be 
           a solution: ringbuffer flushes identical messages in buffer
           and forwards it only one time for each count of messages.
Has anyone more efficient solutions ?
thanks
Micha