Re: Is "last message repeated n times" anything good?
"Marcus J. Ranum" <[email protected]> Tue, 18 Mar 2008 11:43:26 -0400
| Newsgroups | gmane.comp.sysutils.loganalysis |
|---|---|
| Message-ID | <[email protected]> |
Rainer Gerhards wrote: >>From the rsyslog core engine point of view, "last message repeated n >times" is quite costly in terms of code complexity and even performance. I asked Eric Allman about it, once, and he explained that the feature was put in when old apps were first being ported to support syslog. There were a few cases where apps logged 100 megs or so of the same message at a shot, and it was a performance -feature- that syslogd attempted to compact them down to a single line + "message repeated." It's probably no longer necessary since virtually everything that's fielded now was coded with the awareness that log data was potentially going into syslog. Taking it out will probably not be a big problem, except for 3 or 4 people who will experience total meltdowns. So... Go ahead. Do you feel - lucky? mjr.