On Fri, 2007-04-06 at 06:11 -0400, Jim Hendrick wrote:
Thanks for the response. I am not familiar enough with the overall architecture to know where to look to implement something like this (nor have I written any significant code in several years).
Does the message flow create a separate network connection for each 'destination' or would it be at the 'log' level?
Each and every destination network connection has a separate queue. No other queueing is done inside syslog-ng. (e.g. tcp driver has one, which is kept when the connection is broken)
Does it maintain a separate buffer (queue) at the destination level or log level?
per-destination, multiple log statements can refer to the same destination.
I was thinking that one feature that would probably make this more useful would be an internal (or local) alert message related to bandwidth. Something like if the bandwidth exceeds the cap for a given destination send an alert message (once per time interval).
That way you would know (downstream) that log messages were (possibly) being lost, or at least that a bandwidth condition had been reached.
There is currently a "log statistics" message that reports various counters, among others it has a 'dropped' counter for every destination. -- Bazsi