bmfmancini
commented
1 year ago I have been troubleshooting that Syslog threshold issue basically from what I see the threshold count is only checked during the Syslog poll so whatever is sitting in the syslog_incoming table seems the be counted but not the data in the syslog table
if you loop over logger -n point it to the syslog server without a sleep the threshold is triggered add a sleep of 1 min and you will see the threshold does not work
When you have a threshold set in my case a threshold of 20
the threshold will only kick in if a burst of 20 messages come in all at once however if the messages come in gradually the threshold does not seem to work
No errors seen will continue digging in