Rainer's comment with the PID triggered a memory for me. I have tested rate limiting in rsyslog a few years back and my first approach was a script that calls logger. Long story short: they way logger is called, it is a new process every time. The rate limiting as well as $RepeatedMsgReduction check the process ID. If it differs, it is not working on the message.
Here is the article I wrote about it: http://www.rsyslog.com/first-try-to-test-rate-limiting/ It's the very same cause, just a slightly different application. Florian 2014-05-06 9:28 GMT+02:00 Rainer Gerhards <[email protected]>: > On Mon, May 5, 2014 at 10:11 PM, Thomas D. <[email protected]> wrote: > > > Hi, > > > > maybe that's another problem due to mix between old and new syntax and > > therefore it isn't working like expected... but I didn't find something > > in the documentation about this: > > > > My test configuration: > > > > module(load="imuxsock") > > > > $RepeatedMsgReduction on > > > > module( > > load="builtin:omfile" > > Template="RSYSLOG_TraditionalFileFormat" > > FileCreateMode="0644" > > DirCreateMode="0755" > > ) > > > > *.* action( > > type="omfile" > > File="/var/log/test.log" > > FileOwner="root" > > FileGroup="adm" > > ) > > > > > > Now I am generating a lot of repeating messages: > > > > # for i in {1..500} ; do logger -p local5.info -t tester "repeat-test" ; > > done > > > > ...but I see 500 identical messages in /var/test.log. No "last message > > repeated n times" message. > > > > Where's my error? > > > > Thanks! > > > > > FYI: I have checked the code, and I think this should work as you specify > it. I'll next do a lab. I guess that logger inserts something (like a pid?) > that makes the message unique and so does not trigger the code. But that's > just a guess right now. > > Rainer > > (Tested with rsyslog-7.6.3) > > > > > > -Thomas > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > DON'T LIKE THAT. > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
