On Tue, May 6, 2014 at 1:54 AM, Thomas D. <[email protected]> wrote: > Hi, > > when you search the net for "rsyslog.conf" files, you often find > examples where you set > > > auth,authpriv.* /var/log/auth.log > > whereas for all the other facilities/log files you set > > > *.info;mail.none;authpriv.none;cron.none -/var/log/messages > > (the important thing is the "dash" before the log file) > > > From my understanding the user wanted to make sure, that every > authentication event will be logged on disk, whereas for all the other > logs performance was chosen. > > So far right, not? > > not sure. I guess in most cases they copied the conf from somewhere. At least that was the state when we changed these settings years ago. Almost all of the folks who had the dash inside vs. not inside the rule did not know why.
Besides, at least on a busy system, syncing is counter-productive. While what is on the disk stays on the disk, the in-memory queue fills up more rapidly. So in many use cases, activating sync potentially causes *more* message loss. > Now the question is: Is this still valid for v7.6+? > > <http://www.rsyslog.com/doc/v3compatibility.html> says that syncing was > turned off in general, so that you no longer need to set a dash. Still > right? > > Yes. Note that the compatibility notes are cummulative. So should this setting have been changed back after v3, it would be in one of the v3+ compatibility notes (just FYI). Would you still recommend to enable syncing for important files like > "/var/log/auth.log" or not? see above: definitely no > And if you recommend syncing, this can be > rewritten in RainerScript (new syntax) like > > > auth,authpriv.* action( > > type="omfile" > > File="/var/log/auth.log" > > Sync="on" > > ) > > right? > > yes, that's the way to do it. Rainer > > Thanks for all your answers! > > > -Thomas > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
