> I actually (really ;)) do not know syslog-ng and keep myself somewhat > away from it to prevent accidental steal of "whatever" from there. But > now that you raise the point: could you quickly describe how it works. > From your mail, it sounds like what I am thinking about...
I 100% agree with and applaud that separation. As you've stated before, they make a good product and don't warrant any interference. Not touching the docs myself (since I know too much of it by heart anyway), flush_lines allows the admin to configure a particular number of log entries to buffer before forcing a flush to disk, whereas flush_timeout configures the maximum interval between disk flushes. Unlike ramlog, it seems to do this with internal allocations and doesn't rely on a ramdisk. I usually set it rather conservatively (20 and 600 respectively), but I can definitely see being more aggressive on a dedicated log collector with critical power or a laptop in ultra-low power mode. This has been a feature of the public version of syslog-ng for as long as I can remember (or four years, whichever is sooner ;). Combined with disk queues I can see a very nice tiered approach to handling extremely high volumes of log data in a rather reliable manner. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog
