[rsyslog-notify] Forum Thread: Re: pmaixforwardedfrom configuration - (Mode 'reply')

[noreply at adiscon.com]

User: dlang 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=25034#p25034

Message: 
----------
[quote="xdaxdb":20z3906m]Do I need to have the AIX servers send to a
different UDP server than my Linux servers?[/quote:20z3906m]

no, it's designed to not modify any message that doesn't have the "message
forwarded from" in it, so it's safe to use on your main logstream

[quote="xdaxdb":20z3906m]
Was pmaixforwardedfrom intended to be used with AIX running rsyslog, or
with the built-in syslog, or both? I am currently using the standard syslog
and I really don't want to install rsyslog on the AIX
systems.[/quote:20z3906m]

it was designed to deal with the AIX default syslog. It's actually better
to modify the AIX config (I think it needs the -l flag added to turn this
off, but it's been a couple of years), but if you can't due to political
reasons, this module cleans up the logs so that they are easier to handle.

If you can modify the AIX config, also disable the duplicate message
supression. The 'last message repeated X times' is utterly worthless when
you are trying to analyze logs, and it's actively harmful because you then
loose any ability to figure out when a message is being sent a lot.