[logs] Is "last message repeated n times" anything good?

[Rainer Gerhards]

Hi Marcus,

good to know what it was intended for. The problem I am facing is that
some folks, over time, have begun to (ab)use this feature, maybe even
depend on it. If I remove it from the code base, it'll be gone and I
don't know how many meltdowns that'll generate. A few is probably ok,
but more than that may be a problem.

Most importantly, I am trying to understand *what* this feature is
actually being used for. If I se the use cases, there are probably
better ways to achieve the same result. But that depends on someone
stepping up and says "hey, I am actually using it and for this and that
reason". Not much concrete in this direction so far... which is good. If
the overall consensus is "don't care", then I am really lucky ;)

Rainer

> -----Original Message-----
> From: Marcus J. Ranum [mailto:mjr at ranum.com]
> Sent: Tuesday, March 18, 2008 4:43 PM
> To: Rainer Gerhards; loganalysis at loganalysis.org
> Subject: Re: [logs] Is "last message repeated n times" anything good?
> 
> Rainer Gerhards wrote:
> >>From the rsyslog core engine point of view, "last message repeated n
> >times" is quite costly in terms of code complexity and even
> performance.
> 
> I asked Eric Allman about it, once, and he explained that the feature
> was
> put in when old apps were first being ported to support syslog. There
> were
> a few cases where apps logged 100 megs or so of the same message at
> a shot, and it was a performance -feature- that syslogd attempted to
> compact them down to a single line + "message repeated."
> 
> It's probably no longer necessary since virtually everything that's
> fielded
> now was coded with the awareness that log data was potentially going
> into syslog. Taking it out will probably not be a big problem, except
> for
> 3 or 4 people who will experience total meltdowns. So... Go ahead. Do
> you feel - lucky?
> 
> mjr.