[rsyslog-notify] Forum Thread: Re: pmlastmsg clarification - (Mode 'reply')

[noreply at adiscon.com]

User: dlang 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=26293#p26293

Message: 
----------
rulesetparser lines tell rsyslog what parsers to try and apply to the
message to extract the various fields.

the lastline parser remembers the last message it got from the server, so
that when it gets the 'last message repeated' message, it can modify it to
show what that last message was.

note that any sender that does this and doesn't let you disable it is also
probably going to be sending via UDP and the network can reorder packets
under some conditions and if things are rerdered, this is going to give you
bad data.

what is sending you the logs that you are needing to deal with, and what
are you trying to fix with lastlog.

If you put those three rulesetparser lines at the top of the config file,
this module should work and 'fix' the 'last message repeated n times'
messages.