<HTML>
<HEAD>
<TITLE>syslog_ng and NFS</TITLE>
</HEAD>
<BODY>
<FONT FACE="Calibri, Verdana, Helvetica, Arial"><SPAN STYLE='font-size:11pt'>We run syslog-ng (both 1.x and now 2.0.9) on FreeBSD writing log files to a NetApp NFS server. At a very low load we start dropping inbound packets (udp, large socket buffers). A quick tcpdump showed a pathological interaction with NFS revolving around how NFS (at least on BSD) deals with APPEND mode. The upshot is that for each write, it flushes the attributes and actually re-reads the partial file block back from the server!<BR>
<BR>
A simple change to the source – to remove O_APPEND had great results – we can handle 10x the number of inbound messages.<BR>
<BR>
Our .conf file has every logging host going to a separate file, and with a quick scan of the code it sure looked like syslog-ng won’t open the same file more than once anyway (I could be wrong here).<BR>
<BR>
So, a couple questions (I scanned the last few months of archives but didn’t see any discussion about this) - what breaks if anything by turning off APPEND, is this interesting to others/how might I get this into future releases ( I can see this being a per-destination option).<BR>
<BR>
thanks.<BR>
<BR>
<BR>
</SPAN></FONT><FONT SIZE="1"><FONT FACE="Verdana, Helvetica, Arial"><SPAN STYLE='font-size:9pt'>-- <BR>
It is the mark of an instructed mind to rest satisfied<BR>
with the degree of precision which the nature of a subject admits,<BR>
and not to seek exactness when only an approximation of the truth<BR>
is possible.<BR>
Aristotle</SPAN></FONT></FONT><FONT FACE="Calibri, Verdana, Helvetica, Arial"><SPAN STYLE='font-size:11pt'><BR>
</SPAN></FONT>
</BODY>
</HTML>