[logs] Is "last message repeated n times" anything good?

[Rainer Gerhards]

Hi Gord,

that's a good suggestion, and as the v3 branch breaks some background
compatibility in any case this is probably a good time to do it. It
doesn't relieve me of the code overhead, but it could be a good
migration path and a hint to users. Also, I can wait for who complains
and why. No complaint probably equals to a "drop it" vote ;)

Rainer

> -----Original Message-----
> From: Gord Taylor [mailto:taylorgo at gmail.com]
> Sent: Tuesday, March 18, 2008 7:49 PM
> To: Rainer Gerhards
> Cc: loganalysis at loganalysis.org
> Subject: Re: [logs] Is "last message repeated n times" anything good?
> 
> Perhaps taking the opposite approach from what exists today would be
> helpful as an interim.
> 
> Instead of using -e to DISABLE the "message repeats" function, require
> a new parameter to ENABLE it (asking people to contact you in the
> documentation of the parameter). This would improve performance by
> default, and allow you to better guage impact with the expectation of
> ripping out the code in the future. This would also allow an interim
> migration path for vendors who may already manage this message.
> 
> In my experience many people -even in IT-  will avoid change unless
you
> give them a bit of a nudge... but that's a discussion thread for
> another day :)
> 
> On Tue, Mar 18, 2008 at 1:29 PM, Rainer Gerhards
> <rgerhards at hq.adiscon.com> wrote:
> 
> 
> 	Hi Marcus,
> 
> 	good to know what it was intended for. The problem I am facing
is
> that
> 	some folks, over time, have begun to (ab)use this feature, maybe
> even
> 	depend on it. If I remove it from the code base, it'll be gone
> and I
> 	don't know how many meltdowns that'll generate. A few is
probably
> ok,
> 	but more than that may be a problem.
> 
> 	Most importantly, I am trying to understand *what* this feature
> is
> 	actually being used for. If I se the use cases, there are
> probably
> 	better ways to achieve the same result. But that depends on
> someone
> 	stepping up and says "hey, I am actually using it and for this
> and that
> 	reason". Not much concrete in this direction so far... which is
> good. If
> 	the overall consensus is "don't care", then I am really lucky ;)
> 
> 	Rainer
> 
> 
> 	> -----Original Message-----
> 	> From: Marcus J. Ranum [mailto:mjr at ranum.com]
> 	> Sent: Tuesday, March 18, 2008 4:43 PM
> 	> To: Rainer Gerhards; loganalysis at loganalysis.org
> 	> Subject: Re: [logs] Is "last message repeated n times"
anything
> good?
> 	>
> 	> Rainer Gerhards wrote:
> 	> >>From the rsyslog core engine point of view, "last message
> repeated n
> 	> >times" is quite costly in terms of code complexity and even
> 	> performance.
> 	>
> 	> I asked Eric Allman about it, once, and he explained that the
> feature
> 	> was
> 	> put in when old apps were first being ported to support
syslog.
> There
> 	> were
> 	> a few cases where apps logged 100 megs or so of the same
> message at
> 	> a shot, and it was a performance -feature- that syslogd
> attempted to
> 	> compact them down to a single line + "message repeated."
> 	>
> 	> It's probably no longer necessary since virtually everything
> that's
> 	> fielded
> 	> now was coded with the awareness that log data was potentially
> going
> 	> into syslog. Taking it out will probably not be a big problem,
> except
> 	> for
> 	> 3 or 4 people who will experience total meltdowns. So... Go
> ahead. Do
> 	> you feel - lucky?
> 	>
> 	> mjr.
> 
> 	_______________________________________________
> 	LogAnalysis mailing list
> 	LogAnalysis at loganalysis.org
> 	http://www.loganalysis.org/mailman/listinfo/loganalysis
> 
>