Hi List
I am trying to make logs appear so that repeat consecutive messages are
listed in the logs separately, i.e. not like this:
Feb 4th 10:10:03 server last message repeated 5 times
I have tested the syslogd -m switch on a Red Hat box,
server:/etc/init.d# ./syslogd -m 1 (by editing the init file
SYSLOGD_OPTIONS variable)
and this line in /etc/syslog.conf adding the mark.* directive
---other params----mark.* /var/log/messages
This switches time stamping to a one minute period but does not stop
consecutive multiple messages from being compressed.
With an -m value of 1 or greater the grouping of consecutive messages
appears to increase with the value, but only within the given time frame,
so consecutive repeat messages are compressed with the finest granularity
of one minute, which is not useful for rapid network messages for example
that can repeat within a second.
The only other option is a -c switch which is meant to turn off
compression, but this is only available in some non-Linux versions of
syslog, or at least not in Red Hat.
Can anyone advise a method of switching off the repeat (compression) of
exact same consecutive messages.
Thanks Damian
--
Damian Brasher
www.interlinux.co.uk
All mail scanned by clam-av
http://www.clamav.net/
