[Logcheck-devel] [patch] limit rate of messages

[Alexander Elbs]

Hi,

I wrote a patch for finding similar messages in the logcheck output and
compress them.
e.g.:
May 11 13:10:16 foonode funkydaemon: My error message 12345
May 11 13:21:17 barnode funkydaemon: My error message 543
[...]

are compressed to:
May 11 13:10:16 foonode funkydaemon: My error message 12345
Similar messages appear 42 times


messages are similar when they only differ in: logdate, lognode, any number and
any 16-digit hex number.

These 'compressed' messages are put in a different section (e.g. "System
Events, High Rate") and removed from the normal section ("System Events")


For us this reduces (valid) error messages from the lustre filesystem to a
readable amount. And it helps for other floodings, too :)

Attachments:
 - logcheck_ratelimit.patch for /usr/sbin/logcheck
 - logcheck_ratelimit_conf.patch for /etc/logcheck/logcheck.conf

two new options:
RATELIMIT=1 (or 0) to turn this feature on/off
RATELIMIT_RATE=5 to enable compress if >= 5 similar messages


does this patch make sense for you?

Mfg
Alexander Elbs

-- 
Alexander Elbs  ***  eMail alex at segv.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: logcheck_ratelimit.patch
Type: text/x-diff
Size: 4959 bytes
Desc: not available
Url : http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20070511/4f111921/attachment.patch 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: logcheck_ratelimit_conf.patch
Type: text/x-diff
Size: 400 bytes
Desc: not available
Url : http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20070511/4f111921/attachment-0001.patch