Hi,
I wrote a patch for finding similar messages in the logcheck output and
compress them.
e.g.:
May 11 13:10:16 foonode funkydaemon: My error message 12345
May 11 13:21:17 barnode funkydaemon: My error message 543
[...]
are compressed to:
May 11 13:10:16 foonode funkydaemon: My error message 12345
Similar messages appear 42 times
messages are similar when they only differ in: logdate, lognode, any number and
any 16-digit hex number.
These 'compressed' messages are put in a different section (e.g.
"System
Events, High Rate") and removed from the normal section ("System
Events")
For us this reduces (valid) error messages from the lustre filesystem to a
readable amount. And it helps for other floodings, too :)
Attachments:
- logcheck_ratelimit.patch for /usr/sbin/logcheck
- logcheck_ratelimit_conf.patch for /etc/logcheck/logcheck.conf
two new options:
RATELIMIT=1 (or 0) to turn this feature on/off
RATELIMIT_RATE=5 to enable compress if >= 5 similar messages
does this patch make sense for you?
Mfg
Alexander Elbs
--
Alexander Elbs *** eMail alex at segv.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: logcheck_ratelimit.patch
Type: text/x-diff
Size: 4959 bytes
Desc: not available
Url :
http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20070511/4f111921/attachment.patch
-------------- next part --------------
A non-text attachment was scrubbed...
Name: logcheck_ratelimit_conf.patch
Type: text/x-diff
Size: 400 bytes
Desc: not available
Url :
http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20070511/4f111921/attachment-0001.patch