Hi all, [ big snip ]
> > The actual questions are: > > a) is it OK that log data is visible only after the (write) delay? Hmmm.. no. This would eliminate the "magic" of watching system events in real-time as in the commonly used 'tail -n0 -f /var/log/messages' which is often used to troubleshoot problems... Unless you provide some tools to implement such functionality by watching the log events in memory... huh... My 2 cents... Martin > b) does it sound useful to buffer based on allocation unit sizes? > > Thanks, > Rainer > > > > This has been a feature of the public version of syslog-ng for as long > > as I can remember (or four years, whichever is sooner ;). Combined > > with disk queues I can see a very nice tiered approach to handling > > extremely high volumes of log data in a rather reliable manner. > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog
