[syslog-ng] Filtering duplicate messages

[chris packham]

Yes that's the first problem I ran into with my patch. It worked well
with a single host but when I tried it with multiple hosts things got a
bit messy.

The point about timing information is definitely worth noting. This is
often crucial in debugging issues. I wouldn't suggest making this
default behaviour, admins would have to turn it on with the knowledge
that they may lose some timing info (although the first message will
have the correct time).

On Tue, 2008-05-27 at 18:25 +0200, Balazs Scheidler wrote:
> On Mon, 2008-05-26 at 20:05 -0700, stucky wrote:
> > I've been after this since I switched to ng and realized this feature
> > was not migrated over (for reasons beyond me since this was the only
> > good feature of syslog !)
> > I'd be very interested in having this ported to the 2.x branch but I'm
> > not a programmer so I need to rely on you code gurus for that.
> > Nice to see that someone is on it and I'd be happy to help test it !
> 
> the problem with suppressing duplicate messages is that it loses too
> much information, and once you collect messages from several devices
> into the same file, the message "Last message repeated N times" does not
> really have too much information. You lose:
>   * host information
>   * timing
>   * the message itself
> 
> So analyzing this is almost impossible. I might integrate a patch that
> implements this, though.
>