[syslog-ng]Avoid multiple, repeated Logmessage flooding ?

Michael Arndt syslog-ng@lists.balabit.hu
Thu, 22 Apr 2004 14:11:40 +0200


Hello *

is there any practicable solution with syslog-ng to avoid the 
following problem:

40 hosts have the same problem and flood the central loghost with
the identical, many times repeated message

to avoid this ideally one would need an equivalent to :

"last message repeated n times"

Questions: is there any possibility on the receiver (central loghost)
           to filter or drop multiple identical messages ?
           E.g. each hosts entry enters a centarl log only once or n times ?
          
           On sender side  a ringbuffer filter perl script could be 
           a solution: ringbuffer flushes identical messages in buffer
           and forwards it only one time for each count of messages.

Has anyone more efficient solutions ?

thanks
Micha