<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:st1="urn:schemas-microsoft-com:office:smarttags" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="chsdate"/>
<!--[if !mso]>
<style>
st1\:*{behavior:url(#default#ieooui) }
</style>
<![endif]-->
<style>
<!--
/* Font Definitions */
@font-face
{font-family:SimSun;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:SimSun;
panose-1:2 1 6 0 3 1 1 1 1 1;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
text-align:justify;
text-justify:inter-ideograph;
font-size:10.5pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:Arial;
color:windowtext;}
/* Page Definitions */
@page Section1
{size:595.3pt 841.9pt;
margin:72.0pt 90.0pt 72.0pt 90.0pt;
layout-grid:15.6pt;}
div.Section1
{page:Section1;}
-->
</style>
</head>
<body lang=ZH-CN link=blue vlink=purple style='text-justify-trim:punctuation'>
<div class=Section1 style='layout-grid:15.6pt'>
<p class=MsoNormal style='layout-grid-mode:char'><b><font size=3 face=Arial><span
lang=EN-US style='font-size:12.0pt;font-family:Arial;font-weight:bold'>Eenvironment</span></font></b><font
size=3 face=Arial><span lang=EN-US style='font-size:12.0pt;font-family:Arial'> </span></font><font
size=1 face=Arial><span lang=EN-US style='font-size:9.0pt;font-family:Arial'>: <o:p></o:p></span></font></p>
<p class=MsoNormal style='layout-grid-mode:char'><font size=1 face=Arial><span
lang=EN-US style='font-size:9.0pt;font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='layout-grid-mode:char'><font size=1 face=Arial><span
lang=EN-US style='font-size:9.0pt;font-family:Arial'>under linux <o:p></o:p></span></font></p>
<p class=MsoNormal style='layout-grid-mode:char'><font size=1 face=Arial><span
lang=EN-US style='font-size:9.0pt;font-family:Arial'>1 central log-collecting
server.syslog-ng <o:p></o:p></span></font></p>
<p class=MsoNormal style='layout-grid-mode:char'><font size=1 face=Arial><span
lang=EN-US style='font-size:9.0pt;font-family:Arial'>2 client: syslog sending
logs to central log-collecting server.<o:p></o:p></span></font></p>
<p class=MsoNormal style='layout-grid-mode:char'><font size=1 face=Arial><span
lang=EN-US style='font-size:9.0pt;font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=1 face=Arial><span lang=EN-US style='font-size:
9.0pt;font-family:Arial'>And I have two central log-collecting servers which is
logging for different clients,I call them A and B.<o:p></o:p></span></font></p>
<p class=MsoNormal><b><font size=3 face=Arial><span lang=EN-US
style='font-size:12.0pt;font-family:Arial;font-weight:bold'>configuration<o:p></o:p></span></font></b></p>
<p class=MsoNormal><b><font size=1 face=Arial><span lang=EN-US
style='font-size:9.0pt;font-family:Arial;font-weight:bold'>1 The A ` configuration
as follows</span></font></b><font size=1 face=Arial><span lang=EN-US
style='font-size:9.0pt;font-family:Arial'>: <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face=Arial><span lang=EN-US style='font-size:
9.0pt;font-family:Arial'>options { use_dns(no);
create_dirs(yes);ts_format(iso); }; <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face=Arial><span lang=EN-US style='font-size:
9.0pt;font-family:Arial'>source src { udp(ip(<st1:chsdate IsROCDate="False"
IsLunarDate="False" Day="30" Month="12" Year="1899" w:st="on">0.0.0</st1:chsdate>.0)
port(514)); };<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face=Arial><span lang=EN-US style='font-size:
9.0pt;font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=1 face=Arial><span lang=EN-US style='font-size:
9.0pt;font-family:Arial'>filter f_kern { facility(kern); };<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face=Arial><span lang=EN-US style='font-size:
9.0pt;font-family:Arial'>filter f_authpriv { facility(auth,authpriv); };<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face=Arial><span lang=EN-US style='font-size:
9.0pt;font-family:Arial'>filter f_mail { facility(mail); };<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face=Arial><span lang=EN-US style='font-size:
9.0pt;font-family:Arial'>filter f_cron { facility(cron); };<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face=Arial><span lang=EN-US style='font-size:
9.0pt;font-family:Arial'>filter f_boot { facility(local7); };<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face=Arial><span lang=EN-US style='font-size:
9.0pt;font-family:Arial'>filter f_spooler { facility(uucp, news) and
level(crit..emerg); };<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face=Arial><span lang=EN-US style='font-size:
9.0pt;font-family:Arial'>filter f_messages { level(info..emerg) and not
facility(authpriv, cron, mail); };<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face=Arial><span lang=EN-US style='font-size:
9.0pt;font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=1 face=Arial><span lang=EN-US style='font-size:
9.0pt;font-family:Arial'>destination kern { file("/home/syslog-ng/$YEAR/$HOST/kernel-$MONTH");
};<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face=Arial><span lang=EN-US style='font-size:
9.0pt;font-family:Arial'>destination authpriv {
file("/home/syslog-ng/$YEAR/$HOST/secure-$MONTH"); };<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face=Arial><span lang=EN-US style='font-size:
9.0pt;font-family:Arial'>destination mail {
file("/home/syslog-ng/$YEAR/$HOST/maillog-$MONTH"); };<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face=Arial><span lang=EN-US style='font-size:
9.0pt;font-family:Arial'>destination cron {
file("/home/syslog-ng/$YEAR/$HOST/cron-$MONTH"); };<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face=Arial><span lang=EN-US style='font-size:
9.0pt;font-family:Arial'>destination boot {
file("/home/syslog-ng/$YEAR/$HOST/boot.log-$MONTH"); };<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face=Arial><span lang=EN-US style='font-size:
9.0pt;font-family:Arial'>destination spooler {
file("/home/syslog-ng/$YEAR/$HOST/spooler-$MONTH"); };<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face=Arial><span lang=EN-US style='font-size:
9.0pt;font-family:Arial'>destination messages {
file("/home/syslog-ng/$YEAR/$HOST/messages-$MONTH"); };<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face=Arial><span lang=EN-US style='font-size:
9.0pt;font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=1 face=Arial><span lang=EN-US style='font-size:
9.0pt;font-family:Arial'>log { source(src); filter(f_kern); destination(kern);
};<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face=Arial><span lang=EN-US style='font-size:
9.0pt;font-family:Arial'>log { source(src); filter(f_authpriv);
destination(authpriv); };<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face=Arial><span lang=EN-US style='font-size:
9.0pt;font-family:Arial'>log { source(src); filter(f_mail); destination(mail);
};<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face=Arial><span lang=EN-US style='font-size:
9.0pt;font-family:Arial'>log { source(src); filter(f_cron); destination(cron);
};<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face=Arial><span lang=EN-US style='font-size:
9.0pt;font-family:Arial'>log { source(src); filter(f_boot); destination(boot);
};<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face=Arial><span lang=EN-US style='font-size:
9.0pt;font-family:Arial'>log { source(src); filter(f_spooler);
destination(spooler); };<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face=Arial><span lang=EN-US style='font-size:
9.0pt;font-family:Arial'>log { source(src); filter(f_messages);
destination(messages); };<o:p></o:p></span></font></p>
<p class=MsoNormal><b><font size=1 face=Arial><span lang=EN-US
style='font-size:9.0pt;font-family:Arial;font-weight:bold'>2 The B` configuration
as follows: <o:p></o:p></span></font></b></p>
<p class=MsoNormal><font size=1 face=Arial><span lang=EN-US style='font-size:
9.0pt;font-family:Arial'>source src {
unix-stream("/dev/log");internal();udp(ip(<st1:chsdate
IsROCDate="False" IsLunarDate="False" Day="30" Month="12" Year="1899" w:st="on">0.0.0</st1:chsdate>.0)
port(514)); };<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face=Arial><span lang=EN-US style='font-size:
9.0pt;font-family:Arial'>destination dsearch {
file("/home/work/syslog-ng/log/$HOST"); };<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face=Arial><span lang=EN-US style='font-size:
9.0pt;font-family:Arial'>log { source(src); destination(dsearch); };<o:p></o:p></span></font></p>
<p class=MsoNormal><b><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt;font-weight:bold'>QUESTIONS: <o:p></o:p></span></font></b></p>
<p class=MsoNormal><font size=3 face=宋体><span lang=EN-US
style='font-size:12.0pt;font-family:SimSun'>A server log files: ps
aux<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face=宋体><span lang=EN-US
style='font-size:12.0pt;font-family:SimSun'> </span></font><font size=1
face=Arial><span lang=EN-US style='font-size:9.0pt;font-family:Arial'>/home/syslog-ng/2007/
10.11.100.3 / messages %MEM
VSZ RSS<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-indent:94.5pt'><font size=1 face=Arial><span
lang=EN-US style='font-size:9.0pt;font-family:Arial'> 965 directories
3860 6.8
567772 562524<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face=宋体><span lang=EN-US
style='font-size:12.0pt;font-family:SimSun'>B server log files:
ps
aux<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face=宋体><span lang=EN-US
style='font-size:12.0pt;font-family:SimSun'> </span></font><font size=1
face=Arial><span lang=EN-US style='font-size:9.0pt;font-family:Arial'>/home/work/syslog-ng/log/<st1:chsdate
IsROCDate="False" IsLunarDate="False" Day="30" Month="12" Year="1899" w:st="on">10.12.55</st1:chsdate>.6
</span></font><font
size=1 face=Arial><span lang=EN-US style='font-size:9.0pt;font-family:Arial'> %
MEM VSZ RSS</span></font><font size=1
face=Arial><span lang=EN-US style='font-size:9.0pt;font-family:Arial'><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face=Arial><span lang=EN-US style='font-size:
9.0pt;font-family:Arial'>
4482 0.0
2232 1276<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face=Arial><span lang=EN-US style='font-size:
9.0pt;font-family:Arial'>I think the </span></font><font size=1 face=Arial><span
lang=EN-US style='font-size:9.0pt;font-family:Arial'>MEM VSZ and RSS usage is related
to the logfile numbers, </span></font><font size=3 face=宋体><span
lang=EN-US style='font-size:12.0pt;font-family:SimSun'>A server has fewer
logfiles than B server, while </span></font><font size=1 face=Arial><span
lang=EN-US style='font-size:9.0pt;font-family:Arial'> </span></font><font
size=3 face=宋体><span lang=EN-US style='font-size:12.0pt;
font-family:SimSun'>A server has higher usages of </span></font><font
size=1 face=Arial><span lang=EN-US style='font-size:9.0pt;font-family:Arial'>MEM
VSZ and RSS than </span></font><font size=3 face=宋体><span
lang=EN-US style='font-size:12.0pt;font-family:SimSun'>B server,<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face=宋体><span lang=EN-US
style='font-size:12.0pt;font-family:SimSun'>I don`t know why ?</span></font><font
size=1 face=Arial><span lang=EN-US style='font-size:9.0pt;font-family:Arial'><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face="Times New Roman"><span lang=EN-US><o:p> </o:p></span></font></p>
</div>
</body>
</html>