On Thu, 2004-09-02 at 22:42, Dave Johnson wrote:
Syslog-ng is working relatively well; however one performance item:
We have a named pipe configured for non syslog messages and want to add another named pipe from a separate message source (again non-syslog based).
Messages are aggregated and sent centrally.
Centrally messages are broken out /$DATE/$HOST/$FACILITY.
----
Initially messages were just "routing" based on the above information (date/host/facility), creating a nice-straight-forward higher performance configuration.
Now the central server and many of our client machines have to do "extra" items (stamp messages, filter based on certain text), etc...
We are talking about 15-20 gigabytes a day of logs (today), and much more tomorrow. Going through an external program or msg filtering adds a decent amount of CPU on all our machines, especially centrally.
It would be very helpful to have a "set _ facility/level" or (change_facility, change_level) in the destination() or src () or log() section of syslog-ng. This would allow our client machines to be able to src from several files and put data in local0-7.
I've planned these kind of manipulation features for a long time now, however one thing is sure, not in syslog-ng 1.6.x, but rather in the new 2.0 codebase. However it is not stable enough yet, and I currently have other things to do (unless of course I get enough inspiration :) -- Bazsi