[syslog-ng] min and max message count condition in correlation actions

Gergely Nagy algernon at balabit.hu
Tue Apr 16 14:23:28 CEST 2013


Anton Koldaev <koldaevav at gmail.com> writes:

> Balabit guys: any way to force it not to drop messages by rate, but execute
> an action instead? (For example: execute log() if rate >= 10/60s)

I'd love to teach syslog-ng to do that, but that needs quite a bit of
work, and isn't likely to happen anytime soon, I'm afraid. (Unless I'm
missing something, but I find that unlikely.)

-- 
|8]



More information about the syslog-ng mailing list