MonitorWare Knowledge Base

I am looking for an option to rate-limit messages which match a particular filter (e.g. to 1 per hour). syslog-ng commercial supports this but not the GPL fork. Any idea about this?

• Custom written rsyslog.conf?
• Maintenance Contract?
• Installation support?

What do you want to do with messages that are over the rate limit? E.g. if you have limited it to 1 per hour and there arrive 2, 5 or 1,000 within that hour? Simply discard or send them some time later?

Rainer

rgerhards wrote:What do you want to do with messages that are over the rate limit?

Just drop them. This is similar to how syslog normally discards repeating messages and says "Last message repeated 200 times" or somesuch. This is the same scenario except the messages aren't necessarily identical; for instance some application may be flooding you with messages and at some point you want to say "OK, I understand you're not happy, now shut up already".

OK, that sounds fair. I will not promise anything, but I'll see if I can do something these days. If not, it'll be September time-frame.

any news on this topic or is it still for future development, as noted in http://wiki.rsyslog.com/index.php/Future_Development ?

It's unfortunately still for further development. We are hunting a very hard to find bug, and that has unfortunately delayed my scheduled quite a bit

Rainer