syslog shows "last message repeated X times" in /var/log/messages

Support Center > Search Results > SecureKnowledge Details

Technical Level

Solution ID	sk119913
Technical Level
Product	Security Gateway, Security Management
Version	R77.30, R80.10, R80.20
OS	Gaia
Platform / Model	All
Date Created	20-Aug-2017
Last Modified	07-May-2019

Symptoms

An event which is logged in /var/log/messages is generated multiple times in consecutive order, and the syslog daemon compresses all repeated attempts with entry "last message repeated X times" in /var/log/messages file.
Example:
[DATE TIME] [SGW_Name] sshd[3561]: Failed password for admin from 10.110.2.151 port 9807 ssh2 [DATE TIME] [SGW_Name] last message repeated 2 times

Cause

Compressing consecutive events into one entry "last message repeated X times" is default behavior for syslog.

Syslog daemon integrated into Check Point software does not support the syslog flags ( -c, -cc ) to "uncompress/decompress" the syslog event messages.

Solution

Note: To view this solution you need to Sign In .