On Dec 11, 2007 3:01 AM, Rainer Gerhards <[EMAIL PROTECTED]> wrote: > Hi Stephen, > > I was totally swamped the past days, sorry for the missing response. > I'll check what causes this. As a side-note, I think that the message > reduction code does not work well with the database - as you can no > longer query the individual messages. Is this your intent?
My original intent was to have a centralized copy of all the changes that cfengine makes. That works extremely well and saves me a buttload of time over having to log by hand in a shared Excel spreadsheet every time I update a hosts file or tweak httpd.conf or tomcat's server.xml. That and logging the messages from auditd were the main goals. I added /var/log/messages and /var/log/secure mainly because I could and because it gives the Linux side of the shop greater credibility with the SOX (expletive deleted). Now that messages and secure are in the database I'll have to run a log analyzer periodically looking for indications of "stuff" that's not right but that comes after about six other projects. This isn't a show stopper and I could probably just drop the "last messages repeated.." entries without any harm. Tho I;m not sure how jsut yet. Out of 2.4M rows about 385K are of this type. > Rainer > > > > -----Original Message----- > > From: [EMAIL PROTECTED] [mailto:rsyslog- > > [EMAIL PROTECTED] On Behalf Of Stephen Carville > > Sent: Friday, December 07, 2007 10:09 PM > > To: [email protected] > > Subject: [rsyslog] Last Message repeated N times > > > > I am using rsyslog 1.19.10 on a central server to collect messages and > > store them in a mysql database. One thing I've noticed is that the > > "last message repeated NNN times" entries are alway entered with > > FromHost="last", SysLogTag="message", and Message="repeated NNN > > times". Can this be fixed? > > > > I still use the regular sysklogd package on the remote machines to > > forward the messages. > > > > -- > > Stephen Carville > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > -- Stephen Carville _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog
