[syslog-ng] Is the option flush_lines valid now?

Thu Oct 15 11:26:13 CEST 2015

I'd like to tuning the output by priority.
For example,Critical log should be shown immediately, so I set the option flush_line(0).Information should not use much power, so I set the option flush_line(100).
And I want to confirm that the option flush_line is set correctly.So I watch the tail of messages.
Now I have 2 question.
1:How can I confirm the effect of flush_line?2:What number is appropriate to set flush_line to save power?
About syslog-ng 3.7.1, default value of flush_lines is 100.(I read that somewhere)I think to set flush_lines to 0 with high priority log, and set flush_lines to 100(default so do nothing) with another log.Is that reasonable?
Oops! it's three questions!
Date: Thu, 15 Oct 2015 08:21:09 +0200
From: balazs.scheidler at balabit.com
To: syslog-ng at lists.balabit.hu
Subject: Re: [syslog-ng] Is the option flush_lines valid now?

Flush-lines controls the maximum buffer size, but syslog-ng will automatically flush if there's no input. So you will see one message at a time unless messages are streaming in at a high pace.
Flush-lines used to work differently, but was changed when syslog-ng became multithreaded.
What is your usecase where this might be needed?
On Oct 15, 2015 6:31 AM, "伊藤 宏平" <ki0412 at hotmail.com> wrote:

Thank you for your advice.I tried you options.But the problem is same.
I use options below.
options {    chain_hostnames(off);    flush_lines(3);    flush_timeout(5);    use_dns(no);    use_fqdn(no);    owner("root");    group("adm");    perm(0640);    stats_freq(600);    bad_hostname("^gconfd$");};
I try to catch log by tail command.like this "$sudo tail -f /var/log/messages"
I expected to 3 line show at a time.But log shows one by one, when I call logger command.
Could you confirm that the log shows at once? Or one by one?
thanks!

To: syslog-ng at lists.balabit.hu
From: erempel at uvic.ca
Date: Wed, 14 Oct 2015 20:01:54 -0700
Subject: Re: [syslog-ng] Is the option flush_lines valid now?

    What happens when you try to use the
      option.

      I use it with syslog-ng 3.7.1

      options {

              log_fifo_size(20000000);

              use_fqdn(yes);

              keep_hostname(yes);

              chain_hostnames(yes);

              time_reap(60);

              time_reopen(5);

              flush_lines(15000);

              flush_timeout(2000);

              stats_level(1);

              log_msg_size(16384);

      };

      without any problems.

      On 10/14/2015 04:35 PM, 伊藤 宏平 wrote:

      I tried to use syslog-ng.

        At first I used a syslog-ng 3.5.3 on ubuntu14.04.
        But I can not use flush_line option.

        I asked question in stack
            overflow.
        Mr.argus said that " There is a lack of condition"
        linux
            - syslog-ng の flush_lines　オプションが効かない - スタック・オーバーフロー

        Specifically function "log_writer_flush" should be like that.

        Before:

          gboolean
log_writer_flush(LogWriter *self, LogWriterFlushMode flush_mode)
{
                       :

  if (flush_mode >= LW_FLUSH_BUFFER || count == 0)
  {
    if (log_proto_client_flush(proto) == LPS_ER!
 ROR
)
      return FALSE;
  }

        After:

          LogProtoFileWriter *w = (LogProtoFileWriter *)proto;
if ( (w->buf_count >= w->buf_size) && (flush_mode >= LW_FLUSH_BUFFER || count == 0) )
  {
    if (log_proto_client_flush(proto) == LPS_ER!
 ROR
)
      return FALSE;
  }

        And now I use a latest
            syslog-ng ose 3.7.1, hoping the bug has been fixed.
        But I can not use flush_line
            option either.

        Is the option flush_lines
            valid now?

                    try   (動) 

                      試みる、努める、努力する、試す、挑む、見る、審理する  

                    tried   (形)

                      検査済みの、証明済みの、試験済みの  

              Powered by iKnow! 

      This body part will be downloaded on demand.

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq

                advice

                (名)

                助言、アドバイス、勧め

    Powered by iKnow!

______________________________________________________________________________

Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng

Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng

FAQ: http://www.balabit.com/wiki/syslog-ng-faq

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq

                priority

                (名)

                優先事項、重要なこと、優先、優先順位

    Powered by iKnow!

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20151015/a2e0f848/attachment-0001.htm 