[nycbug-talk] syslog "compression"?

Charles Sprickman spork
Mon Dec 12 23:00:26 EST 2005


Hi all,

I wonder if anyone here has some insight on this problem I'm having... 
FreeBSD's syslog by default will "compress" (their word) repetitive 
messages, like so:

Dec 12 22:14:58 spamd2 clamd[32226]: stream: Worm.Sober.U FOUND
Dec 12 22:15:25 spamd2 last message repeated 38 times
Dec 12 22:20:35 spamd3 last message repeated 59 times

>From my reading of the manpage, I can only turn this behaviour off for all 
logfiles that syslogd handles.  Am I parsing that correctly?  In many 
cases having the compression feature on is quite helpful.  But with my 
clamd logs on this logserver, I'd like each line left as is so they can be 
counted by my stats program.

If the stock syslogd can't do this, what is a popular replacement that's 
safe to have open to a number of hosts, routers and switches on the 
network?

Thanks,

Charles




More information about the talk mailing list