Forum Discussion
hooleylist
Feb 23, 2010Cirrostratus
The is probably from syslog-ng suppressing duplicate messages:
http://devcentral.f5.com/wiki/default.aspx/iRules/log
...syslog-ng will still perform suppression of repeated duplicates.
From the syslog-ng v2.0 manual, there is a suppress option which will summarize all duplicate messages within an interval. By default this is disabled though. And I couldn't find anywhere in the default syslog-ng.conf or 'b syslog list all' output where it is configured. But I have seen this suppression consistently when logging duplicate messages in quick succession.
http://www.balabit.com/dl/guides/syslog-ng-v2.0-guide-admin-en.pdf
Name: suppress()
Type: seconds
Default: 0 (disabled)
Description:
When enabled and syslog-ng would send several messages
with identical content to the destination, syslog-ng sends only
a single message and a line Last message repeated n
times.. The parameter of this option specifies the number of
seconds syslog-ng waits for identical messages.
Aaron