On Tue, Sep 07, 2010 at 07:25:37PM -0600, syslogng@feystorm.net wrote:
Syslog-ng already has the exact functionality you are looking for (at least as far as I understand what youre wanting).
Excellent! Thanks for the advice. This is why I ask about things before implementing bad or unnecessary code. ;-)
Create a udp destination driver, set flush_timeout to 60000 (60 seconds), and flush_lines to 0 (the default).
Makes sense except for the caveat I'll ask about below.
Syslog-ng will queue all the destination messages until the oldest message is 60 seconds old, and then flushes them all out at once.
This part is tricky. How do I tell if I have received all the messages? How do I know when I have hit the end of the batch? Is it possible to have the daemon insert a marker message, or is there some other way I can check for this? Thanks, Matthew.