>>> - Compression of equal/similar(?) lines at the originating host.
>> This should be accomplished with a repetition count assigned to
>> messages. "Last message repeated NNN times" make it quite difficult
>> to find the original message.
...huh? It's the last line before the "last message repeated" lines.
> The "last line repeated" stuff has the advantage of having the line
> logged at least once, even if the system crashes later on (DoS
> attack).
It also has the problem that if you're watching the logs and not much
else is happening, you can think only one event took place when in fact
more are occurring and getting swallowed up into a "repeated N times"
line that will (presumably) get logged at some indefinite future time.
I'd like to see a timeout, so that after (say) 10 seconds, the
"repeated" line is logged anyway even if nothing else has happened.
(This is an implementation detail, but such details are not entirely
out of our purview; while we shouldn't specify too much of the
implementation, we can have SHOULDs that describe qualities like this
in generic terms.)
der Mouse
[EMAIL PROTECTED]
7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B
