[rsyslog] suggested tweak to rsyslog

[Rainer Gerhards]

> -----Original Message-----
> From: rsyslog-bounces at lists.adiscon.com [mailto:rsyslog-
> bounces at lists.adiscon.com] On Behalf Of david at lang.hm
> Sent: Friday, December 19, 2008 1:04 PM
> To: rsyslog-users
> Subject: Re: [rsyslog] suggested tweak to rsyslog
 
> it's definantly a pain for analysers 

Full ack

> (a _lot_ of them really only look
> at
> one line at a time), that's why I started tweaking this on sysklogd,
> and
> while in theory just disabling it is the right answer, the ability to
> take
> a flood of inbound messages and reduce them to a much smaller number
> can
> save your logging system when things go wrong
> 
> I'll watch to see what happens.

I just dug out a the relevant link, please follow also to the mailing
list discussion:

http://kb.monitorware.com/post5789.html

Rainer