katsumi liquer wrote:
Hi Mike,
Wow -- that is cool!! I have not heard of that parameter before. I
think I could probably use that -- if I set the rate limit high
enough, perhaps it would prevent syslog from suppressing duplicate
messages. The problem though is that I am guessing this only applies
to messages coming from the kernel; other processes which talk to
syslog directly will probably still trigger suppression I'm guessing.
For example, several repeated failure messages from sshd will generate
this message:
"last message repeated"
This is basically the situation:
http://www.syslog.org/PNphpBB2-viewtopic-t62-.phtml
I have never been able to find the official RedHat solution to the
problem, short of rebuilding a custom syslog
Hi Again, sorry I was not very clear or helpful in my message ( I was in
a hurry :) )
- the kernel rate_limit is just for kernel messages
- syslog does suppress repeated messages. I don't know what the method
is for detecting the repeated messages.. The important point to be aware
of is that this is a 'syslog for Linux' feature, and not a Red Hat
specific thing. Also it's probably not considered a problem, that is why
there is not official Red Hat solution.
I'd consider syslog-ng as it's much more configurable. You won't have to
modify syslog at all, and pre-built packages are available for RHEL4.
Cheers
Michael
--
redhat-list mailing list
unsubscribe mailto:redhat-list-request@xxxxxxxxxx?subject=unsubscribe
https://www.redhat.com/mailman/listinfo/redhat-list
