[rsyslog] Feedback requested "Last message logged n times"...

[Rainer Gerhards]

Hi all,

once again, I am in need for feedback. In order to be
backwards-compatible with sysklogd, rsyslogd supported the "last message
repeated n times" message compression feature. However, this feature is
prone to causing user trouble. Some even think that it is a design flaw
(see this discussion on the loganalysis mailing list, this posting is
probably a good entry point into a lengthy thread:
http://www.loganalysis.org/pipermail/loganalysis/2008-January/000547.htm
l ).

>From the rsyslog core engine point of view, "last message repeated n
times" is quite costly in terms of code complexity and even performance.
There is a -e command line switch to turn it off, which most users seem
to do (and those that don't do it often seem to run into troubles).

I am very tempted to DROP this feature from future builds. That would
result in a great code complexity reduction (really, it takes a lot of
effort...) and probably also rid us of a standard trouble spot. However,
it also means that its compression features are no longer available. 

Question now: does anybody actually need this feature? If so, why is it
good?

Please provide feedback.

Thanks,
Rainer