syslog message suppression

[Chris Harris_1]

Hi Guys,

in the syslog.log file you often see a line like 'last message repeated 4 times', for example. This I assume is to save space. Is there any way of stopping this suppression,and logging everything to the file?

I need to scan the log file and count how many times an event actually occurs.

regards,

Chris.

[Pete Randall]

Chris,

Do a man on syslogd. The -r option is what you're looking for.

Pete

[fg_1]

Hi chris

It probably means that they have the -a option on which suppresses duplicate messages.

If you want to see all the messages as they come up then do this then restart your syslog with the -r option which says dont suppress messages.

Hope this helps.

FG.

[S.K. Chan]

Yes, you can restart syslogd with "-r" and also edit /sbin/init.d/syslogd to include the option so that subsequent restart of syslogd takes effect. Just beware .. your syslog.log can easily gets filled up. I've seen critical error message got repeated a few hundred times.

[Martin Johnson]

This is slightly off the topic:

We monitor the syslog.log file (and similar files under other Unix OSs) with ITO for problems. We have come across a situation where the syslog daemon is running but not writing to the syslog file.

One of our "brilliant" engineers wrote a script that uses logger to write a message to the syslog file then uses grep to see if the message is in the logfile. If it is not, he then recycles the syslog daemon.

Our "brilliant" engineer set his script to run every 5 minutes. Since he sends the same message every time his script is run, the syslog daemon replaces the message with "last message repeated...". Naturelly, the grep does not match and his script recycles the syslog daemon.

To add insult to injury, this "brilliant" engineer uses logger to notify us that the syslog daemon has been recycled. Logger attempts to send the messsage before the syslog daemon is completely recycled, and causes the daemon to crash!

Marty

[Rodney Hills]

Chris,

If you are looking for a count of an event and you are scanning syslog anyway, couldn't you key on the "last message" line, extract the number and add that to your counter?

My 2 cents...

-- Rod Hills