<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#0050d0">
<br>
<br>
Sent: Martedì 7 Settembre 2010 19.42.52<br>
From: Matthew Hall <a class="moz-txt-link-rfc2396E" href="mailto:mhall@mhcomputing.net"><mhall@mhcomputing.net></a><br>
To: Syslog-ng users' and developers' mailing list
<a class="moz-txt-link-rfc2396E" href="mailto:syslog-ng@lists.balabit.hu"><syslog-ng@lists.balabit.hu></a> <br>
Subject: Re: [syslog-ng] Buffering AF_UNIX Destination, Batch Post
Processing Messages<br>
<blockquote cite="mid:20100908014252.GA30044@mhcomputing.net"
type="cite">
<blockquote type="cite">
<pre wrap="">Syslog-ng will queue all the destination messages until the oldest
message is 60 seconds old, and then flushes them all out at once.
</pre>
</blockquote>
<pre wrap=""><!---->
This part is tricky. How do I tell if I have received all the messages?
How do I know when I have hit the end of the batch? Is it possible to
have the daemon insert a marker message, or is there some other way I
can check for this?
</pre>
</blockquote>
I do not believe there is an elegant way. Best idea I can come up with
is to put a timeout on the receiving end so that when it goes quiet for
more than X seconds or whatnot, it sees that as end of batch.<br>
You might be able to request that the mark option be allowed for
non-local destinations. Basically that would allow you to set a mark of
1 second, and when you receive 2 mark messages back-to-back, that would
be end-of-batch (would basically mean there was no data in between).<br>
<blockquote cite="mid:20100908014252.GA30044@mhcomputing.net"
type="cite">
<pre wrap="">
Thanks,
Matthew.
______________________________________________________________________________
Member info: <a class="moz-txt-link-freetext" href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a>
Documentation: <a class="moz-txt-link-freetext" href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a>
FAQ: <a class="moz-txt-link-freetext" href="http://www.campin.net/syslog-ng/faq.html">http://www.campin.net/syslog-ng/faq.html</a>
</pre>
</blockquote>
</body>
</html>