That's not a silly one ;) And it is coming up every now and then. The last time it came up, I was smart enough to write a blogpost: http://blog.gerhards.net/2008/03/on-rsyslog-design-philosophy-plugins.ht ml
In short, and to this questions: there are different schools of thought. If you think about a plain ole syslogd shuffling data to disk files, you do not need that. My vision of the syslogd (actually the "event logging and alerting") subsystem is much broader. IMHO, it should support anything that is needed to gather, process and persistently store events. Also note that I say "events" for a reason - syslog messages are just a subset of the potential set of events. Rainer > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:rsyslog- > [EMAIL PROTECTED] On Behalf Of (private) HKS > Sent: Friday, August 01, 2008 4:25 PM > To: rsyslog-users > Subject: Re: [rsyslog] Alert when multiple repeated lines are found > > This may be a silly question, but is the syslog daemon the proper > place for something like this? > > -HKS > > On Fri, Aug 1, 2008 at 6:13 AM, Julian Yap <[EMAIL PROTECTED]> > wrote: > > Roger that Rainer. > > > > Thanks, > > Julian > > > > On Thu, Jul 31, 2008 at 11:58 PM, Rainer Gerhards > > <[EMAIL PROTECTED]> wrote: > >> OK, that greatly simplifies things. Actually, it now boils down to > >> "execute an action only on the n-the time the filter evaluates to > true". > >> I think this is quite easy to implement, but I must verify that... > >> > >> Rainer > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog
