[logs] Is "last message repeated n times" anything good?

[Gord Taylor]

Perhaps taking the opposite approach from what exists today would be helpful
as an interim.

Instead of using -e to DISABLE the "message repeats" function, require a new
parameter to ENABLE it (asking people to contact you in the documentation of
the parameter). This would improve performance by default, and allow you to
better guage impact with the expectation of ripping out the code in the
future. This would also allow an interim migration path for vendors who may
already manage this message.

In my experience many people -even in IT-  will avoid change unless you give
them a bit of a nudge... but that's a discussion thread for another day :)
On Tue, Mar 18, 2008 at 1:29 PM, Rainer Gerhards <rgerhards at hq.adiscon.com>
wrote:

> Hi Marcus,
>
> good to know what it was intended for. The problem I am facing is that
> some folks, over time, have begun to (ab)use this feature, maybe even
> depend on it. If I remove it from the code base, it'll be gone and I
> don't know how many meltdowns that'll generate. A few is probably ok,
> but more than that may be a problem.
>
> Most importantly, I am trying to understand *what* this feature is
> actually being used for. If I se the use cases, there are probably
> better ways to achieve the same result. But that depends on someone
> stepping up and says "hey, I am actually using it and for this and that
> reason". Not much concrete in this direction so far... which is good. If
> the overall consensus is "don't care", then I am really lucky ;)
>
> Rainer
>
> > -----Original Message-----
> > From: Marcus J. Ranum [mailto:mjr at ranum.com]
> > Sent: Tuesday, March 18, 2008 4:43 PM
> > To: Rainer Gerhards; loganalysis at loganalysis.org
> > Subject: Re: [logs] Is "last message repeated n times" anything good?
> >
> > Rainer Gerhards wrote:
> > >>From the rsyslog core engine point of view, "last message repeated n
> > >times" is quite costly in terms of code complexity and even
> > performance.
> >
> > I asked Eric Allman about it, once, and he explained that the feature
> > was
> > put in when old apps were first being ported to support syslog. There
> > were
> > a few cases where apps logged 100 megs or so of the same message at
> > a shot, and it was a performance -feature- that syslogd attempted to
> > compact them down to a single line + "message repeated."
> >
> > It's probably no longer necessary since virtually everything that's
> > fielded
> > now was coded with the awareness that log data was potentially going
> > into syslog. Taking it out will probably not be a big problem, except
> > for
> > 3 or 4 people who will experience total meltdowns. So... Go ahead. Do
> > you feel - lucky?
> >
> > mjr.
>
> _______________________________________________
> LogAnalysis mailing list
> LogAnalysis at loganalysis.org
> http://www.loganalysis.org/mailman/listinfo/loganalysis
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.loganalysis.org/pipermail/loganalysis/attachments/20080318/921b39e1/attachment.html