LinuxQuestions.org
Go Job Hunting at the LQ Job Marketplace
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices

Reply
 
Search this Thread
Old 07-25-2005, 01:52 PM   #1
whysyn
Member
 
Registered: Jun 2003
Location: Cleveburg, OH
Distribution: mostly Fedora
Posts: 154

Rep: Reputation: 30
msyslog hack - stop the "last message repeated" insanity???


Hello everybody!

I'm working on a custom real-time log parser for a few of my systems (written in Perl). Basically, it tails a log file, ignores some messages, inserts others into a database on a remote host, and performs custom actions based on other messages.

The "last message repeated x times" messages are really messing with my ability to parse messages.

I'm using msyslog on the systems. Does anybody know of a way to disable this behavior? Whether it's some hidden config switch or a source code patch, or anything - I'm willing to try it.

Thank you,
Eric
 
Old 04-26-2006, 10:34 AM   #2
polymath69
LQ Newbie
 
Registered: Oct 2004
Distribution: Debian, Ubuntu, DSL, TRK, etc.
Posts: 18

Rep: Reputation: 3
Patch

This looks like a very easy thing to change... looking at the source for 1.08g, I think it's a one-liner. Not tested, though!

Look around line 825:
/*
* suppress duplicate lines to this file
*/
>> if ((flags & MARK) == 0 && msglen == f->f_prevlen &&
!strcmp(msg, f->f_prevline) &&
!strcmp(from, f->f_prevhost)) {

Change that line to if (0 && (flags & MARK) == 0 {etc}. and you ought to be good to go.

The danger, of course, is that if something malfunctions, logging thousands of lines of the same thing, you might fill up your log filesystem, which can be tricky to recover from, depending. But... your call.

Good luck!
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
FC4 install errors, "diabling IRQ #10" "nobody cares" error message??? A6Quattro Fedora 6 07-20-2005 12:49 PM
How to stop the redhat sending me e-mail called "LogWatch" automatically? chuanweizuo Red Hat 2 03-08-2005 09:19 AM
"Pseudo" Installs - a new way to hack into a system? DJ Shaji Linux - Security 3 12-19-2004 09:52 PM
error message when pressing "Next" "BIOS Problems" , help ! HeRCuLeSX Fedora 3 07-21-2004 02:37 PM
Pepsi iTunes "hack" witeshark General 4 02-23-2004 02:06 PM


All times are GMT -5. The time now is 05:55 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration