<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:$B%a%$%j%*(B
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>I'd like to tuning the output by priority.<div><br></div><div>For example,</div><div>Critical log should be shown immediately, so I set the option flush_line(0).</div><div>Information should not use much power, so I set the option flush_line(100).</div><div><br></div><div>And I want to confirm that the option flush_line is set correctly.</div><div>So I watch the tail of messages.</div><div><br></div><div>Now I have 2 question.</div><div><br></div><div>1:How can I confirm the effect of flush_line?</div><div>2:What number is appropriate to set flush_line to save power?</div><div><br></div><div>About syslog-ng 3.7.1, default value of flush_lines is 100.(I read that somewhere)</div><div>I think to set flush_lines to 0 with high priority log, and set flush_lines to 100(default so do nothing) with another log.</div><div>Is that reasonable?</div><div><br></div><div>Oops! it's three questions!</div><div><br><div><hr id="stopSpelling">Date: Thu, 15 Oct 2015 08:21:09 +0200<br>From: balazs.scheidler@balabit.com<br>To: syslog-ng@lists.balabit.hu<br>Subject: Re: [syslog-ng] Is the option flush_lines valid now?<br><br><p dir="ltr">Flush-lines controls the maximum buffer size, but syslog-ng will automatically flush if there's no input. So you will see one message at a time unless messages are streaming in at a high pace.</p>
<p dir="ltr">Flush-lines used to work differently, but was changed when syslog-ng became multithreaded.</p>
<p dir="ltr">What is your usecase where this might be needed?</p>
<div class="ecxgmail_quote">On Oct 15, 2015 6:31 AM, "$B0KF#(B $B9(J?(B" <<a href="mailto:ki0412@hotmail.com">ki0412@hotmail.com</a>> wrote:<br><blockquote class="ecxgmail_quote" style="border-left:1px #ccc solid;padding-left:1ex;">
<div><div dir="ltr"><div>Thank you for your advice.</div><div>I tried you options.</div><div>But the problem is same.</div><div><br></div>I use options below.<div><br></div><div><div>options {</div><div> chain_hostnames(off);</div><div> flush_lines(3);</div><div> flush_timeout(5);</div><div> use_dns(no);</div><div> use_fqdn(no);</div><div> owner("root");</div><div> group("adm");</div><div> perm(0640);</div><div> stats_freq(600);</div><div> bad_hostname("^gconfd$");</div><div>};</div><div><br></div><div>I try to catch log by tail command.</div><div>like this "<span style="font-size:12pt;">$sudo tail -f /var/log/messages"</span></div><div><br></div><div>I expected to 3 line show at a time.</div><div><span style="font-size:12pt;">But log shows one by one, when I call logger command.</span></div><div><span style="font-size:12pt;"><br></span></div><div><span style="font-size:12pt;">Could you confirm that the log shows at once? Or one by one?</span></div><div><span style="font-size:12pt;"><br></span></div><div>thanks!</div><div><br></div><div><br></div><div><hr>To: <a href="mailto:syslog-ng@lists.balabit.hu" target="_blank">syslog-ng@lists.balabit.hu</a><br>From: <a href="mailto:erempel@uvic.ca" target="_blank">erempel@uvic.ca</a><br>Date: Wed, 14 Oct 2015 20:01:54 -0700<br>Subject: Re: [syslog-ng] Is the option flush_lines valid now?<br><br>
<div>What happens when you try to use the
option.<br>
<br>
I use it with syslog-ng 3.7.1<br>
<br>
options {<br>
log_fifo_size(20000000);<br>
use_fqdn(yes);<br>
keep_hostname(yes);<br>
chain_hostnames(yes);<br>
time_reap(60);<br>
time_reopen(5);<br>
flush_lines(15000);<br>
flush_timeout(2000);<br>
stats_level(1);<br>
log_msg_size(16384);<br>
};<br>
<br>
<br>
without any problems.<br>
<br>
<br>
On 10/14/2015 04:35 PM, $B0KF#(B $B9(J?(B wrote:<br>
</div>
<blockquote>
<div dir="ltr">I tried to use syslog-ng.
<div><br>
</div>
<div>At first I used a syslog-ng 3.5.3 on <span style="color:rgb(34,34,34);font-family:'Helvetica Neue',Helvetica,Arial,sans-serif;font-size:15px;line-height:19.5px;background-color:rgb(255,255,255);">ubuntu14.04.</span></div>
<div>But I can not use flush_line option.</div>
<div><br>
</div>
<div><span style="font-size:12pt;">I asked question in stack
overflow.</span></div>
<div>Mr.argus said that " There is a lack of condition"</div>
<div><a href="http://ja.stackoverflow.com/questions/12836/syslog-ng-%E3%81%AE-flush-lines-%E3%82%AA%E3%83%97%E3%82%B7%E3%83%A7%E3%83%B3%E3%81%8C%E5%8A%B9%E3%81%8B%E3%81%AA%E3%81%84" target="_blank">linux
- syslog-ng $B$N(B flush_lines$B!!%*%W%7%g%s$,8z$+$J$$(B - $B%9%?%C%/!&%*!<%P!<%U%m!<(B</a></div>
<div><br>
</div>
<div>Specifically function "<span style="font-family:Consolas,Menlo,Monaco,'Lucida Console','Liberation Mono','DejaVu Sans Mono','Bitstream Vera Sans Mono','Courier New',monospace,sans-serif;white-space:inherit;font-size:13px;background-color:rgb(238,238,238);">log_writer_flush"</span><span style="font-size:12pt;"> should be like that.</span></div>
<div><span style="font-size:12pt;"><br>
</span></div>
<div><span style="font-size:12pt;">Before:</span></div>
<div><span style="font-size:12pt;"><br>
</span></div>
<div>
<pre style="padding:5px;border:0px;font-size:13px;overflow:auto;width:auto;max-height:600px;font-family:Consolas,Menlo,Monaco,'Lucida Console','Liberation Mono','DejaVu Sans Mono','Bitstream Vera Sans Mono','Courier New',monospace,sans-serif;color:rgb(57,51,24);word-wrap:normal;background-color:rgb(238,238,238);"><code style="padding:0px;border:0px;font-family:Consolas,Menlo,Monaco,'Lucida Console','Liberation Mono','DejaVu Sans Mono','Bitstream Vera Sans Mono','Courier New',monospace,sans-serif;white-space:inherit;"><span style="padding:0px;border:0px;color:rgb(0,0,0);">gboolean
log_writer_flush</span><span style="padding:0px;border:0px;color:rgb(0,0,0);">(</span><span style="padding:0px;border:0px;color:rgb(43,145,175);">LogWriter</span><span style="padding:0px;border:0px;color:rgb(0,0,0);"> </span><span style="padding:0px;border:0px;color:rgb(0,0,0);">*</span><span style="padding:0px;border:0px;color:rgb(0,0,0);">self</span><span style="padding:0px;border:0px;color:rgb(0,0,0);">,</span><span style="padding:0px;border:0px;color:rgb(0,0,0);"> </span><span style="padding:0px;border:0px;color:rgb(43,145,175);">LogWriterFlushMode</span><span style="padding:0px;border:0px;color:rgb(0,0,0);"> flush_mode</span><span style="padding:0px;">)</span><span style="padding:0px;border:0px;color:rgb(0,0,0);">
</span><span style="padding:0px;border:0px;color:rgb(0,0,0);">{</span><span style="padding:0px;border:0px;color:rgb(0,0,0);">
</span><span style="padding:0px;border:0px;color:rgb(0,0,0);">:</span><span style="padding:0px;border:0px;color:rgb(0,0,0);">
</span><span style="padding:0px;border:0px;color:rgb(0,0,139);">if</span><span style="padding:0px;border:0px;color:rgb(0,0,0);"> </span><span style="padding:0px;border:0px;color:rgb(0,0,0);">(</span><span style="padding:0px;border:0px;color:rgb(0,0,0);">flush_mode </span><span style="padding:0px;border:0px;color:rgb(0,0,0);">>=</span><span style="padding:0px;border:0px;color:rgb(0,0,0);"> LW_FLUSH_BUFFER </span><span style="padding:0px;border:0px;color:rgb(0,0,0);">||</span><span style="padding:0px;border:0px;color:rgb(0,0,0);"> count </span><span style="padding:0px;border:0px;color:rgb(0,0,0);">==</span><span style="padding:0px;border:0px;"> </span><span style="padding:0px;border:0px;color:rgb(128,0,0);">0</span><span style="padding:0px;border:0px;color:rgb(0,0,0);">)</span><span style="padding:0px;border:0px;color:rgb(0,0,0);">
</span><span style="padding:0px;border:0px;color:rgb(0,0,0);">{</span><span style="padding:0px;border:0px;color:rgb(0,0,0);">
</span><span style="padding:0px;border:0px;color:rgb(0,0,139);">if</span><span style="padding:0px;border:0px;color:rgb(0,0,0);"> </span><span style="padding:0px;border:0px;color:rgb(0,0,0);">(</span><span style="padding:0px;border:0px;color:rgb(0,0,0);">log_proto_client_flush</span><span style="padding:0px;border:0px;color:rgb(0,0,0);">(</span><span style="padding:0px;border:0px;color:rgb(0,0,0);">proto</span><span style="padding:0px;border:0px;color:rgb(0,0,0);">)</span><span style="padding:0px;border:0px;color:rgb(0,0,0);"> </span><span style="padding:0px;border:0px;color:rgb(0,0,0);">==</span><span style="padding:0px;border:0px;color:rgb(0,0,0);"> LPS_ER!
ROR</span>
<span style="padding:0px;border:0px;color:rgb(0,0,0);">)</span><span style="padding:0px;border:0px;color:rgb(0,0,0);">
</span><span style="padding:0px;border:0px;color:rgb(0,0,139);">return</span><span style="padding:0px;border:0px;color:rgb(0,0,0);"> FALSE</span><span style="padding:0px;border:0px;color:rgb(0,0,0);">;</span><span style="padding:0px;border:0px;color:rgb(0,0,0);">
</span><span style="padding:0px;border:0px;color:rgb(0,0,0);">}</span></code></pre>
</div>
<div>After:</div>
<div><br>
</div>
<div>
<pre style="padding:5px;border:0px;font-size:13px;overflow:auto;width:auto;max-height:600px;font-family:Consolas,Menlo,Monaco,'Lucida Console','Liberation Mono','DejaVu Sans Mono','Bitstream Vera Sans Mono','Courier New',monospace,sans-serif;color:rgb(57,51,24);word-wrap:normal;background-color:rgb(238,238,238);"><code style="padding:0px;border:0px;font-family:Consolas,Menlo,Monaco,'Lucida Console','Liberation Mono','DejaVu Sans Mono','Bitstream Vera Sans Mono','Courier New',monospace,sans-serif;white-space:inherit;"><span style="padding:0px;border:0px;color:rgb(43,145,175);">LogProtoFileWriter</span><span style="padding:0px;border:0px;color:rgb(0,0,0);"> </span><span style="padding:0px;border:0px;color:rgb(0,0,0);">*</span><span style="border:0px;color:rgb(0,0,0);">w </span><span style="padding:0px;border:0px;color:rgb(0,0,0);">=</span><span style="padding:0px;border:0px;color:rgb(0,0,0);"> </span><span style="padding:0px;border:0px;color:rgb(0,0,0);">(</span><span style="padding:0px;border:0px;color:rgb(43,145,175);">LogProtoFileWriter</span><span style="padding:0px;border:0px;color:rgb(0,0,0);"> </span><span style="padding:0px;border:0px;color:rgb(0,0,0);">*)</span><span style="padding:0px;border:0px;color:rgb(0,0,0);">proto</span><span style="padding:0px;border:0px;color:rgb(0,0,0);">;</span><span style="padding:0px;border:0px;color:rgb(0,0,0);">
</span><span style="padding:0px;border:0px;color:rgb(0,0,139);">if</span><span style="padding:0px;border:0px;color:rgb(0,0,0);"> </span><span style="padding:0px;border:0px;color:rgb(0,0,0);">(</span><span style="padding:0px;border:0px;color:rgb(0,0,0);"> </span><span style="padding:0px;border:0px;color:rgb(0,0,0);">(</span><span style="padding:0px;border:0px;color:rgb(0,0,0);">w</span><span style="padding:0px;border:0px;color:rgb(0,0,0);">-></span><span style="padding:0px;border:0px;color:rgb(0,0,0);">buf_count </span><span style="padding:0px;border:0px;color:rgb(0,0,0);">>=</span><span style="padding:0px;border:0px;color:rgb(0,0,0);"> w</span><span>-></span><span style="padding:0px;border:0px;color:rgb(0,0,0);">buf_size</span><span style="padding:0px;border:0px;color:rgb(0,0,0);">)</span><span style="padding:0px;border:0px;color:rgb(0,0,0);"> </span><span style="padding:0px;border:0px;color:rgb(0,0,0);">&&</span><span style="padding:0px;border:0px;color:rgb(0,0,0);"> </span><span style="padding:0px;border:0px;color:rgb(0,0,0);">(</span><span style="padding:0px;border:0px;color:rgb(0,0,0);">flush_mode </span><span style="padding:0px;border:0px;color:rgb(0,0,0);">>=</span><span style="padding:0px;border:0px;color:rgb(0,0,0);"> LW_FLUSH_BUFFER </span><span>||</span><span style="padding:0px;border:0px;color:rgb(0,0,0);"> count </span><span style="padding:0px;border:0px;color:rgb(0,0,0);">==</span><span style="padding:0px;border:0px;color:rgb(0,0,0);"> </span><span style="padding:0px;border:0px;color:rgb(128,0,0);">0</span><span style="padding:0px;border:0px;color:rgb(0,0,0);">)</span><span style="padding:0px;border:0px;color:rgb(0,0,0);"> </span><span style="padding:0px;border:0px;color:rgb(0,0,0);">)</span><span style="padding:0px;border:0px;color:rgb(0,0,0);">
</span><span style="padding:0px;border:0px;color:rgb(0,0,0);">{</span><span style="padding:0px;border:0px;color:rgb(0,0,0);">
</span><span style="padding:0px;border:0px;color:rgb(0,0,139);">if</span><span style="padding:0px;border:0px;color:rgb(0,0,0);"> </span><span style="padding:0px;border:0px;color:rgb(0,0,0);">(</span><span style="padding:0px;border:0px;color:rgb(0,0,0);">log_proto_client_flush</span><span style="padding:0px;border:0px;color:rgb(0,0,0);">(</span><span style="padding:0px;border:0px;color:rgb(0,0,0);">proto</span><span style="padding:0px;border:0px;color:rgb(0,0,0);">)</span><span style="padding:0px;border:0px;color:rgb(0,0,0);"> </span><span style="padding:0px;border:0px;color:rgb(0,0,0);">==</span><span style="padding:0px;border:0px;color:rgb(0,0,0);"> LPS_ER!
ROR</span>
<span style="padding:0px;border:0px;color:rgb(0,0,0);">)</span><span style="padding:0px;border:0px;color:rgb(0,0,0);">
</span><span style="padding:0px;border:0px;color:rgb(0,0,139);">return</span><span style="padding:0px;border:0px;color:rgb(0,0,0);"> FALSE</span><span style="padding:0px;border:0px;color:rgb(0,0,0);">;</span><span style="padding:0px;border:0px;color:rgb(0,0,0);">
</span><span style="padding:0px;border:0px;color:rgb(0,0,0);">}</span></code></pre>
</div>
<div><span style="font-size:12pt;"><br>
</span></div>
<div><span style="font-size:12pt;">And now I use a latest
syslog-ng ose 3.7.1, hoping the bug has been fixed.</span></div>
<div><span style="font-size:12pt;">But I can not use flush_line
option either.</span></div>
<div><span style="font-size:12pt;"><br>
</span></div>
<div><span style="font-size:12pt;">Is the option flush_lines
valid now?</span></div>
<div>
<pre style="padding:5px;border:0px;font-size:13px;overflow:auto;width:auto;max-height:600px;font-family:Consolas,Menlo,Monaco,'Lucida Console','Liberation Mono','DejaVu Sans Mono','Bitstream Vera Sans Mono','Courier New',monospace,sans-serif;color:rgb(57,51,24);word-wrap:normal;background-color:rgb(238,238,238);"></pre>
</div>
<div>
<div><u></u><u></u></div>
<div>
<u></u>
<div>
<u></u>
<div> <span></span> </div>
<div> <span> try </span> <span> ($BF0(B) </span>
<span>
$B;n$_$k!"EX$a$k!"EXNO$9$k!";n$9!"D)$`!"8+$k!"?3M}$9$k(B </span> <br>
</div>
<div> <span></span> </div>
<u></u>
<u></u>
<div> <span></span> </div>
<div> <span> tried </span> <span> ($B7A(B)
</span> <span>
$B8!:::Q$_$N!">ZL@:Q$_$N!";n83:Q$_$N(B </span> <br>
</div>
<div> <span></span> </div>
<u></u>
</div>
<u></u>
<u></u> <a href="http://iknow.jp" target="_blank"> Powered by <span>iKnow!</span> </a>
<u></u>
</div>
</div>
</div>
<br>
<fieldset></fieldset>
<br>
<pre>This body part will be downloaded on demand.</pre>
</blockquote>
<br>
<br>______________________________________________________________________________
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a></div></div><div style="display:block;"><div><u></u><u></u></div><div><u></u>
<div>
<u></u>
<div>
<span></span>
</div>
<div>
<span>
advice
</span>
<span>
($BL>(B)
</span>
<span>
$B=u8@!"%"%I%P%$%9!"4+$a(B
</span>
<br>
</div>
<div>
<span></span>
</div>
<u></u>
</div>
<u></u>
<u></u>
<a href="http://iknow.jp" target="_blank">
Powered by <span>iKnow!</span>
</a>
<u></u>
</div></div> </div></div>
<br>______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
<br></blockquote></div>
<br>______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq</div><div id="iknow-qtip-0" class="iknow-qtip iknow-qtip-default iknow-qtip-light iknow-qtip-shadow iknow-qtip-rounded iknow-qtip-fixed iknow-qtip-focus iknow-qtip-pos-tc" tracking="false" role="alert" aria-live="polite" aria-atomic="false" aria-describedby="iknow-qtip-0-content" aria-hidden="false" data-qtip-id="0" style="z-index: 2147483001; left: 131px; top: 24px; display: block;"><div class="iknow-qtip-tip" style="display: none;"><canvas></canvas></div><div class="iknow-qtip-content" id="iknow-qtip-0-content" aria-atomic="true"><section class="dictionary-tooltip-inner">
<div class="entries-list">
<article class="entry">
<div class="entry-column audio" data-lemma="priority">
<span class="play-sound"></span>
</div>
<div class="entry-column definition">
<span class="lemma">
priority
</span>
<span class="part-of-speech" data-type="noun">
($BL>(B)
</span>
<span class="definition-text">
$BM%@h;v9`!"=EMW$J$3$H!"M%@h!"M%@h=g0L(B
</span>
<BR>
</div>
<div class="entry-column feedback">
<span class="flag-entry" data-form="priority" data-lemma="priority" data-translation="$BM%@h;v9`!"=EMW$J$3$H!"M%@h!"M%@h=g0L(B" data-part-of-speech="noun"></span>
</div>
</article>
</div>
</section>
<section class="iknow-branding">
<a href="http://iknow.jp" target="_blank">
Powered by <span class="brand">iKnow!</span>
</a>
</section>
</div></div></div> </div></body>
</html>