Thanx. Dupe filtering sounds very close. Is there a way to "append" a summary to the message itself ? Something like
Event id 1, Msg: Invalid input value : 45 [2 in last 5 sec] Also I am thinking it would be nicer (though more complicated) to collapse dupe across a time window. If we check just for the last event then it might still cause event log flooding. For example if an error causes 2 different events (different ids) to be logged and if this error happens too often (say per request) then the dupe checker that checks only with previous error will allow these messages and end up with log flooding. So here is an example of what I have in mind. Example: Input: Event id 1, Msg: Invalid input value : 45 Event id 1, Msg: Invalid input value : 45 Event id 1, Msg: Invalid input value : 800 <= Message is different though event id is same Event id 2, Msg: Permission denied for user: xyz <= Different event id Event id 2, Msg: Permission denied for user: xyz Output: Event id 1, Msg: Invalid input value : 45 [2 in last 5 sec] Event id 1, Msg: Invalid input value : 800 [1 in last 5 sec] Event id 2, Msg: Permission denied for user: xyz [2 in last 5 sec] If I can get help on how to add summary to a message, I can implement the dupe check part using a hash. Thanx Regards Pranav From: Ron Grabowski [mailto:[EMAIL PROTECTED] Sent: Saturday, May 03, 2008 11:52 AM To: Log4NET User Subject: Re: Throttling/Rollup feature in EventLogAppender It looks like that class was written a while ago so you may already know this...you should be able to extend the built-in ForwardingAppender and let it handle the IAppenderAttachable stuff so the Append methods would look something like this: public class DupeFilteringForwardingAppender : ForwardingAppender { protected override void Append(LoggingEvent loggingEvent) { base.Append(CheckForDupe(loggingEvent)); } protected override void Append(LoggingEvent[] loggingEvents) { List<LoggingEvent> filteredLoggingEventList = new List<LoggingEvent>(); foreach (LoggingEvent loggingEvent in loggingEvents) { filteredLoggingEventList.AddRange(CheckForDupe(loggingEvent)); } base.Append(filteredLoggingEventList.ToArray()); } // snip } ----- Original Message ---- From: Jerry Shea <[EMAIL PROTECTED]> To: log4net-user@logging.apache.org Sent: Saturday, May 3, 2008 12:50:13 AM Subject: Re: Throttling/Rollup feature in EventLogAppender Hi Pranav, James Wilkinson and I worked up some code to do this. See http://markmail.org/message/pahnqti7yq4xoz7m I am currently the bottleneck on this having not responded to James' last message :(. I'll get moving and hopefully we can contribute this code to the community soon. Cheers, Jerry ---------- Forwarded message ---------- From: Pranav Varia <[EMAIL PROTECTED]<mailto:[EMAIL PROTECTED]>> To: "log4net-user@logging.apache.org<mailto:log4net-user@logging.apache.org>" <log4net-user@logging.apache.org<mailto:log4net-user@logging.apache.org>> Date: Fri, 2 May 2008 14:00:08 -0700 Subject: Throttling/Rollup feature in EventLogAppender Is there a Throttling feature available or planned in EventLogAppender. If we log to event log a message that could potentially be logged at frequency of one per incoming request to my web application, it could flood the event log with millions of messages if/when things go wrong. If there was a = way to roll them up every x seconds into a single event log message (with a count of how many messages where rolledup), it would be useful to me. Is there any such feature? Or workaround? Regards Pranav
