This sounds a bit like you are looking for this:
https://www.rsyslog.com/doc/tutorials/log_sampling.html
HTH
Rainer
El mié, 3 abr 2024 a las 3:25, Prasad Koya via rsyslog
(<rsyslog@lists.adiscon.com>) escribió:
>
> Hi
>
>
> module( load="imuxsock" )
> module( load="imklog" )
>
> if ($syslogfacility-text == 'kern' and $msg contains "Out of memory") then {
> action(type="omfile" queue.size="1000" queue.type="LinkedList"
> queue.dequeueSlowDown="3600000000" file="/var/log/oom")
> }
>
>
> If we have a flurry of, for example, "Out of memory" messages from the
> facility 'kern', we'd like to keep only, say, one per hour in a
> separate file.
>
> https://rsyslog.readthedocs.io/en/latest/rainerscript/queue_parameters.html
> says do not set low value for queue.size.
>
> Above page also says queue.dequeueslowdown can be used as
> rate-limiting. Maybe that doesn't apply for "omfile" as I don't see
> above rsyslog.conf working. high and low watermarks are not applicable
> here as it's not a disk based queue. Appreciate any pointers.
>
> Thank you.
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
> LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
