Suppress "last message repeated x times"

[n***@notreal.com]

Is there of way of suppressing “last message repeated x times” in
syslog.conf so that each message is actually logged, or even better, so
that each message destined for a particular log file is actually
recorded. I would like all failed logins in sshd.log to be recorded
to make “fail2 ban" work more consistently when an automated login
script is rapid firing logins.

[Clemens Ladisch]

Is there of way of suppressing “last message repeated x times” in syslog.conf

No; sysklogd has no option for this. You'd have to switch to rsyslog.


Regards,
Clemens

[n***@notreal.com]

Post by Clemens Ladisch

Is there of way of suppressing “last message repeated x times” in syslog.conf

No; sysklogd has no option for this. You'd have to switch to rsyslog.
Regards,
Clemens

I guess that would explain why a search could not find an answer no
matter what I used for search terms :). Thanks for taking the time to
reply, and I will look into rsyslog.

[buck]

Is there of way of suppressing “last message repeated x times”

in

syslog.conf so that each message is actually logged, or even better, so
that each message destined for a particular log file is actually
recorded. I would like all failed logins in sshd.log to be

recorded

to make “fail2 ban" work more consistently when an automated login
script is rapid firing logins.

extract the source for sysklogd and modify syslogd.c:

if (f->f_type == F_CONSOLE && (flags & IGN_CONS))
continue;

/* don't output marks to recently written files */
if ((flags & MARK) && (now - f->f_time) < MarkInterval
/ 2)
continue;

/*
* suppress duplicate lines to this file
*/
/* kill last message repeated # times
if ((flags & MARK) == 0 && msglen == f->f_prevlen &&
!strcmp(msg, f->f_prevline) &&
!strcmp(from, f->f_prevhost)) {
*/
if (0) {
(void) strncpy(f->f_lasttime, timestamp, 15);
f->f_prevcount++;
dprintf("msg repeated %d times, %ld sec of %d.
\n",


Thanks to Jim Diamond for this!

[n***@notreal.com]

Post by n***@notreal.com

Post by n***@notreal.com
Is there of way of suppressing “last message repeated x times”

in

Post by n***@notreal.com
syslog.conf so that each message is actually logged, or even better,

so

Post by n***@notreal.com
that each message destined for a particular log file is actually
recorded. I would like all failed logins in sshd.log to be

recorded

Post by n***@notreal.com
to make “fail2 ban" work more consistently when an automated login
script is rapid firing logins.

if (f->f_type == F_CONSOLE && (flags & IGN_CONS))
continue;
/* don't output marks to recently written files */
if ((flags & MARK) && (now - f->f_time) < MarkInterval
/ 2)
continue;
/*
* suppress duplicate lines to this file
*/
/* kill last message repeated # times
if ((flags & MARK) == 0 && msglen == f->f_prevlen &&
!strcmp(msg, f->f_prevline) &&
!strcmp(from, f->f_prevhost)) {
*/
if (0) {
(void) strncpy(f->f_lasttime, timestamp, 15);
f->f_prevcount++;
dprintf("msg repeated %d times, %ld sec of %d.
\n",
Thanks to Jim Diamond for this!

A thank you to both you and Jim for this. I will have to give a try.

[Jim Diamond]

Post by n***@notreal.com

Post by n***@notreal.com
Is there of way of suppressing “last message repeated x times”

in

Post by n***@notreal.com
syslog.conf so that each message is actually logged, or even better,

so

Post by n***@notreal.com
that each message destined for a particular log file is actually
recorded. I would like all failed logins in sshd.log to be

recorded

Post by n***@notreal.com
to make “fail2 ban" work more consistently when an automated login
script is rapid firing logins.

if (f->f_type == F_CONSOLE && (flags & IGN_CONS))
continue;
/* don't output marks to recently written files */
if ((flags & MARK) && (now - f->f_time) < MarkInterval
/ 2)
continue;
/*
* suppress duplicate lines to this file
*/
/* kill last message repeated # times
if ((flags & MARK) == 0 && msglen == f->f_prevlen &&
!strcmp(msg, f->f_prevline) &&
!strcmp(from, f->f_prevhost)) {
*/
if (0) {
(void) strncpy(f->f_lasttime, timestamp, 15);
f->f_prevcount++;
dprintf("msg repeated %d times, %ld sec of %d.
\n",
Thanks to Jim Diamond for this!

Geez... how long ago was that?

[buck]

Post by Jim Diamond

Post by buck
Thanks to Jim Diamond for this!

Geez... how long ago was that?

Early June (9th), 2010

And continued thanks for help.

[Jim Diamond]

Post by buck

Post by Jim Diamond

Post by buck
Thanks to Jim Diamond for this!

Geez... how long ago was that?

Early June (9th), 2010

Your record keeping is very good ;-)

Post by buck
And continued thanks for help.

You're welcome. And I'm glad you are getting lasting value out of that.

Cheers.

Jim