[prev in list] [next in list] [prev in thread] [next in thread] 

List:       syslog-ng
Subject:    Re: [syslog-ng] multiple source/destination setup
From:       Bill Nash <billn () billn ! net>
Date:       2005-06-29 15:29:29
Message-ID: Pine.LNX.4.63.0506291537390.1608 () bacchus ! billn ! net
[Download RAW message or body]


On Wed, 29 Jun 2005, Kevin wrote:

> On 6/28/05, William Bell <williamb@cwie.net> wrote:
>> Here is a copy of the conf file with only the private info adjusted.
> . . .
>>         log_fifo_size(0);
> . . .
>>         sync(1);
> . . .
>
> Ouch.  With these settings, syslog-ng isn't doing any internal buffering,
> In my experience, a high-volume logger needs these two values set high,
> I use the following:
>
>        sync(256);
>        log_fifo_size(4095);
>
> With these settings, we are currently processing UDP syslog data

At one point, the configuration Will cites above was tossing 20GB per day 
through a single device, with no appreciable loss, relying mostly on the 
stock kernel send-q and rcv-q for buffering. YMMV. =)

- billn
_______________________________________________
syslog-ng maillist  -  syslog-ng@lists.balabit.hu
https://lists.balabit.hu/mailman/listinfo/syslog-ng
Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

[prev in list] [next in list] [prev in thread] [next in thread]