Re: [Sshguard-users] syslog compression freebsd

[Willem J. W. <wj...@di...>]

On 2-9-2015 02:02, li...@la... wrote:
>
> I noticed the post regarding syslog compression. I put this in
> rc.conf, just addding the dash c to the syslogd_flags:
>
> syslogd_enable="YES" # Run syslog daemon (or NO).
> syslogd_program="/usr/sbin/syslogd" # path to syslogd, if you want a
> different one.
> syslogd_flags="-s -c" # Flags to syslogd (if
> enabled).
>
> But I still get compression.
>
> Sep 1 05:58:42 theranch sshd[3218]: error: PAM: authentication error
> for root from 221.203.142.71 Sep 1 05:58:43 theranch last message
> repeated 2 times

Otehr issue will be that you need 2* -c, since sshguard is not logging 
thru a pipe, but probably calling it via syslog(3)

-c      Disable the compression of repeated instances of the same line
         into a single line of the form ``last message repeated N times''
         when the output is a pipe to another program.  If specified
         twice, disable this compression in all cases.

--WjW