Strange times in syslog

[Tony Constantine]

Hi,

I am a bit confused, looking at the syslog entries it appears that the times of the su entries are abit slow:
Aug 23 10:33:50 deirdre su: + tty?? root-oracle
Aug 23 10:53:45 deirdre su: + tty?? root-oracle
Aug 23 15:53:50 deirdre above message repeats 237 times
Aug 23 10:53:50 deirdre su: + tty?? root-oracle
Aug 23 11:13:50 deirdre su: + tty?? root-oracle
Aug 23 16:13:50 deirdre above message repeats 238 times
Aug 23 11:13:55 deirdre su: + tty?? root-oracle
Aug 23 11:33:50 deirdre su: + tty?? root-oracle
Aug 23 16:33:50 deirdre above message repeats 237 times
Aug 23 11:33:55 deirdre su: + tty?? root-oracle

Is this something that is usual?

Thnx

[Florian Heigl (new acc) · Accepted solution]

syslogd does cumulate (I hope that's the right word) repeating entries:

Aug 23 10:53:45 deirdre su: + tty?? root-oracle
Aug 23 15:53:50 deirdre above message repeats 237 times

means there's 237 identical messages following the first one.

[Mel Burslan]

Yes it is usual. If the events came one after the other without any interruptions from any other notifications in between, syslogd, in order to preserve disk space, and minimize disk i/o, counts the number of times and slaps it behind the original message instead of repeating the same message over and over again.

[Alan Meyer_4]

Whats more curious to me is that the timestamps are not sequential.. does the repeat message come through and consolidate things at a later time?

[Florian Heigl (new acc)]

the 'repeat' kicks in as soon as the messages starts repeating, and collects them. from what it appears, the total number of su's should have been 700something, with a few being collected and a few coming through directly.

I can't tell You for sure :(