rsyslog

[Matthew Miller]

On Sat, Jun 15, 2013 at 01:36:54PM -0700, Adam Williamson wrote:
> There are settings for rotating / pruning the logs
> in /etc/systemd/journald.conf , but they don't seem to work terribly
> well when you have huge single files. A manual discard command might be
> nice, but what I was thinking of RFE'ing was some kind of rate limiting,
> especially for identical messages. I'm not sure anyone really _needs_
> the same AVC printed into their logs every three seconds; just a note
> that a given AVC had occurred 1000 times in the last hour or whatever
> would be sufficient.

There *is* rate limiting, but maybe it needs more fine-tuning.

RateLimitInterval=, RateLimitBurst=

    Configures the rate limiting that is applied to all messages generated
    on the system. If in the time interval defined by RateLimitInterval=
    more messages than specified in RateLimitBurst= are logged by a service
    all further messages within the interval are dropped, until the interval
    is over. A message about the number of dropped messages is generated.
    This rate limiting is applied per-service, so that two services which
    log do not interfere with each other's limits. Defaults to 200 messages
    in 10s. The time specification for RateLimitInterval= may be specified
    in the following units: s, min, h, ms, us. To turn off any kind of rate
    limiting, set either value to 0.


I've often had the _opposite_ problem, where some program spitting out
tracebacks or other verbose information gets cut off.


-- 
Matthew Miller  ☁☁☁  Fedora Cloud Architect  ☁☁☁  <mattdm at fedoraproject.org>