pmlastmsg: last message repeated n times
========================================

**Module Name:    pmlastmsg**

**Module Type:    parser module**

**Author:**\ Rainer Gerhards <rgerhards@adiscon.com>

**Available Since**: 5.5.6

**Description**:

Some syslogds are known to emit severily malformed messages with content
"last message repeated n times". These messages can mess up message
reception, as they lead to wrong interpretation with the standard
RFC3164 parser. Rather than trying to fix this issue in pmrfc3164, we
have created a new parser module specifically for these messages. The
reason is that some processing overhead is involved in processing these
messages (they must be recognized) and we would not like to place this
toll on every user but only on those actually in need of the feature.
Note that the performance toll is not large -- but if you expect a very
high message rate with tenthousands of messages per second, you will
notice a difference.

This module should be loaded first inside :doc:`rsyslog's parser
chain </concepts/messageparser>`. It processes all those messages that
contain a PRI, then none or some spaces and then the exact text
(case-insensitive) "last message repeated n times" where n must be an
integer. All other messages are left untouched.

**Configuration Parameters**:

Note: parameter names are case-insensitive.

There do not currently exist any configuration parameters for this
module.

**Examples:**

This example is the typical use case, where some systems emit malformed
"repeated msg" messages. Other than that, the default :rfc:`5424` and
:rfc:`3164` parsers should be used. Note that when a parser is specified,
the default parser chain is removed, so we need to specify all three
parsers. We use this together with the default ruleset.

::

   $ModLoad pmlastmsg   # This parser is not a built-in module.

   # Note that parsers are tried in the order they appear in
   # rsyslog.conf, so put pmlastmsg first.

   $RulesetParser rsyslog.lastline

   # As we have removed the default parser chain, we need to add the
   # default parsers as well.
   $RulesetParser rsyslog.rfc5424
   $RulesetParser rsyslog.rfc3164

   # Here come the typical rules, like... \*.\* /path/to/file.log

**Caveats/Known Bugs:**

currently none