rsyslog RateLimitInterval and RateLimitBurst constraints

CentOS utilizes rsyslog to manage system logging, employing $RateLimitInterval and $RateLimitBurst to prevent log flooding and notification noise. These directives define the maximum number of messages allowed within a specific time window before subsequent identical messages are suppressed.

The challenge arises when balancing the suppression of repetitive noise against the need to capture genuine burst alerts from active services. Default thresholds may inadvertently mask critical system events during high-load periods, yet overly permissive settings can saturate storage or trigger alert fatigue.

• How do these rate-limiting directives behave when integrated with systemd-journald on CentOS Stream 9?
• What is the impact on alert visibility when custom thresholds are applied globally versus per-facility?