<p dir="ltr"><br>
On Oct 15, 2015 11:26 AM, "伊藤 宏平" <<a href="mailto:ki0412@hotmail.com">ki0412@hotmail.com</a>> wrote:<br>
><br>
> I'd like to tuning the output by priority.<br>
><br>
> For example,<br>
> Critical log should be shown immediately, so I set the option flush_line(0).<br>
> Information should not use much power, so I set the option flush_line(100).<br>
><br>
> And I want to confirm that the option flush_line is set correctly.<br>
> So I watch the tail of messages.<br>
><br>
> Now I have 2 question.<br>
><br>
> 1:How can I confirm the effect of flush_line?</p>
<p dir="ltr">With recent versions of syslog-ng, flush-lines will be ignored unless the buffer contains messages but that only happens if you already have considerable log traffic. What is the message rate we are talking about?</p>
<p dir="ltr">By the time syslog-ng receives the message it is already woken up, so I guess it should also finish writing the message.<br>
But this is only my opinion I have no personal experience with tuning for power consumption.</p>
<p dir="ltr">> 2:What number is appropriate to set flush_line to save power?</p>
<p dir="ltr">I dunno, it wasn't meant to be a power saving parameter, rather it was meant to improve output performance.<br>
><br>
> About syslog-ng 3.7.1, default value of flush_lines is 100.(I read that somewhere)<br>
> I think to set flush_lines to 0 with high priority log, and set flush_lines to 100(default so do nothing) with another log.<br>
> Is that reasonable?</p>
<p dir="ltr">Yes, this means that highprio messages will get written as soon as they were received, even if there are further messages sitting in the output buffer.<br></p>
<p dir="ltr">><br>
> Oops! it's three questions!<br>
><br>
> ________________________________<br>
> Date: Thu, 15 Oct 2015 08:21:09 +0200<br>
> From:<a href="mailto:balazs.scheidler@balabit.com"> balazs.scheidler@balabit.com</a><br>
> To:<a href="mailto:syslog-ng@lists.balabit.hu"> syslog-ng@lists.balabit.hu</a><br>
><br>
> Subject: Re: [syslog-ng] Is the option flush_lines valid now?<br>
><br>
> Flush-lines controls the maximum buffer size, but syslog-ng will automatically flush if there's no input. So you will see one message at a time unless messages are streaming in at a high pace.<br>
><br>
> Flush-lines used to work differently, but was changed when syslog-ng became multithreaded.<br>
><br>
> What is your usecase where this might be needed?<br>
><br>
> On Oct 15, 2015 6:31 AM, "伊藤 宏平" <<a href="mailto:ki0412@hotmail.com">ki0412@hotmail.com</a>> wrote:<br>
>><br>
>> Thank you for your advice.<br>
>> I tried you options.<br>
>> But the problem is same.<br>
>><br>
>> I use options below.<br>
>><br>
>> options {<br>
>> chain_hostnames(off);<br>
>> flush_lines(3);<br>
>> flush_timeout(5);<br>
>> use_dns(no);<br>
>> use_fqdn(no);<br>
>> owner("root");<br>
>> group("adm");<br>
>> perm(0640);<br>
>> stats_freq(600);<br>
>> bad_hostname("^gconfd$");<br>
>> };<br>
>><br>
>> I try to catch log by tail command.<br>
>> like this "$sudo tail -f /var/log/messages"<br>
>><br>
>> I expected to 3 line show at a time.<br>
>> But log shows one by one, when I call logger command.<br>
>><br>
>> Could you confirm that the log shows at once? Or one by one?<br>
>><br>
>> thanks!<br>
>><br>
>><br>
>> ________________________________<br>
>> To:<a href="mailto:syslog-ng@lists.balabit.hu"> syslog-ng@lists.balabit.hu</a><br>
>> From:<a href="mailto:erempel@uvic.ca"> erempel@uvic.ca</a><br>
>> Date: Wed, 14 Oct 2015 20:01:54 -0700<br>
>> Subject: Re: [syslog-ng] Is the option flush_lines valid now?<br>
>><br>
>> What happens when you try to use the option.<br>
>><br>
>> I use it with syslog-ng 3.7.1<br>
>><br>
>> options {<br>
>> log_fifo_size(20000000);<br>
>> use_fqdn(yes);<br>
>> keep_hostname(yes);<br>
>> chain_hostnames(yes);<br>
>> time_reap(60);<br>
>> time_reopen(5);<br>
>> flush_lines(15000);<br>
>> flush_timeout(2000);<br>
>> stats_level(1);<br>
>> log_msg_size(16384);<br>
>> };<br>
>><br>
>><br>
>> without any problems.<br>
>><br>
>><br>
>> On 10/14/2015 04:35 PM, 伊藤 宏平 wrote:<br>
>>><br>
>>> I tried to use syslog-ng.<br>
>>><br>
>>> At first I used a syslog-ng 3.5.3 on ubuntu14.04.<br>
>>> But I can not use flush_line option.<br>
>>><br>
>>> I asked question in stack overflow.<br>
>>> Mr.argus said that " There is a lack of condition"<br>
>>> linux - syslog-ng の flush_lines オプションが効かない - スタック・オーバーフロー<br>
>>><br>
>>> Specifically function "log_writer_flush" should be like that.<br>
>>><br>
>>> Before:<br>
>>><br>
>>> gboolean<br>
>>> log_writer_flush(LogWriter *self, LogWriterFlushMode flush_mode)<br>
>>> {<br>
>>> :<br>
>>><br>
>>> if (flush_mode >= LW_FLUSH_BUFFER || count == 0)<br>
>>> {<br>
>>> if (log_proto_client_flush(proto) == LPS_ER!<br>
>>> ROR<br>
>>> )<br>
>>> return FALSE;<br>
>>> }<br>
>>><br>
>>> After:<br>
>>><br>
>>> LogProtoFileWriter *w = (LogProtoFileWriter *)proto;<br>
>>> if ( (w->buf_count >= w->buf_size) && (flush_mode >= LW_FLUSH_BUFFER || count == 0) )<br>
>>> {<br>
>>> if (log_proto_client_flush(proto) == LPS_ER!<br>
>>> ROR<br>
>>> )<br>
>>> return FALSE;<br>
>>> }<br>
>>><br>
>>><br>
>>> And now I use a latest syslog-ng ose 3.7.1, hoping the bug has been fixed.<br>
>>> But I can not use flush_line option either.<br>
>>><br>
>>> Is the option flush_lines valid now?<br>
>>><br>
>>> try (動) 試みる、努める、努力する、試す、挑む、見る、審理する <br>
>>> tried (形) 検査済みの、証明済みの、試験済みの <br>
>>> Powered by iKnow!<br>
>>><br>
>>><br>
>>> This body part will be downloaded on demand.<br>
>><br>
>><br>
>><br>
>> ______________________________________________________________________________ Member info:<a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng"> https://lists.balabit.hu/mailman/listinfo/syslog-ng</a> Documentation:<a href="http://www.balabit.com/support/documentation/?product=syslog-ng"> http://www.balabit.com/support/documentation/?product=syslog-ng</a> FAQ:<a href="http://www.balabit.com/wiki/syslog-ng-faq"> http://www.balabit.com/wiki/syslog-ng-faq</a><br>
>> advice (名) 助言、アドバイス、勧め <br>
>> Powered by iKnow!<br>
>><br>
>> ______________________________________________________________________________<br>
>> Member info:<a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng"> https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
>> Documentation:<a href="http://www.balabit.com/support/documentation/?product=syslog-ng"> http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
>> FAQ:<a href="http://www.balabit.com/wiki/syslog-ng-faq"> http://www.balabit.com/wiki/syslog-ng-faq</a><br>
>><br>
>><br>
><br>
> ______________________________________________________________________________ Member info:<a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng"> https://lists.balabit.hu/mailman/listinfo/syslog-ng</a> Documentation:<a href="http://www.balabit.com/support/documentation/?product=syslog-ng"> http://www.balabit.com/support/documentation/?product=syslog-ng</a> FAQ:<a href="http://www.balabit.com/wiki/syslog-ng-faq"> http://www.balabit.com/wiki/syslog-ng-faq</a><br>
> priority (名) 優先事項、重要なこと、優先、優先順位 <br>
> Powered by iKnow!<br>
><br>
> ______________________________________________________________________________<br>
> Member info:<a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng"> https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
> Documentation:<a href="http://www.balabit.com/support/documentation/?product=syslog-ng"> http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
> FAQ:<a href="http://www.balabit.com/wiki/syslog-ng-faq"> http://www.balabit.com/wiki/syslog-ng-faq</a><br>
><br>
><br>
</p>