Another syslog issue - is there an easy fix?

[harner]

So, here's an interesting tid bit of information for you all. In a month's time, the MySQL syslog database has gone up to 4GB, which zipped to 140MB. We were able to create a script (which is now a weekly cron job) to dump the table information and then zip it.

Anyway, here is where the "Removals" come into play. We have about 70 rules. I just realized that they only work when you create them at first.

For example, if I create a rule stating if a message containing the phrase "non spam" is made, then remove it - it will remove all of the logs with "non spam" in there.
HOWEVER, if a "new" log with the "non spam" phrase is made, it doesn't remove that. It's like we have to recreate the removal scripts. What's up with that?

Thanks.

[nahun]

There has been some problems with the removal part of the plugin. It might have been fixed with version 0.4, but I'm not sure. I fixed it once myself, but its been a long time and I never use the removal part now. Also my current cacti implementation doesn't have that fix so I wouldn't know how to do it again without a bunch of time.

The big thread for the plugin has a lot of info. I would start with page 8 (where the link puts you). But, a lot of that is for older versions. Its probably changed a lot by now.

[cigamit]

Are you logging directly into the syslog table? Or are you using the syslog_incoming table? I have seen a few users try to bypass the syslog_incoming table, but its where all the rules are applied.