Hi I'm not sure weather the message gets written or not to the file eventually (there is no specific message I was able to track) so I cannot answer your question with absolute certainty. If I had to guess than I'd say it does get written to the file eventually. I think that the problem is in the way that syslog write the messages to the files. From what I read then on every message that is received a single write() is done. This means that each destination gets opened and closed repeatedly (and this was confirmed by running `fuser` on each of the files). On my server there are a few destinations (the ones that belong to the firewalls) that are so busy that they are constantly open or are opened/closed in such a pace that it's impossible to track manually. Might it be that in such a scenario messages will 1st be written to a destination that is already open and messages to destinations that are closed will wait an undefined amount of time? Is there a way I can track what happens with a specific message in syslog-ng? TIA Paolo --- Balazs Scheidler <bazsi@balabit.hu> wrote:
On Mon, 2005-12-26 at 03:14 -0800, Paolo Supino wrote:
Hi
Here is an update on the interval in writing to the log file: the output of ls -l on the file: -rw-r--r-- 1 root root 6234 Dec 26 08:03 switch-01.log and the last messsege coming in on the NIC (captured by tcpdump): 12:56:57.564348 IP switch-01.1024 > syslog.hot.net.il.syslog: UDP, length 75 As you can see the time interval is almost 5 hours... :-(
I can't see how this could happen, log_fifo_size only specifies the maximum size of the buffer and does not increase write latency on its own.
Does the message arrive to the destination at the end? Because if it is not then probably it is an unrelated issue. The only thing that affects write latency is sync()
-- Bazsi
_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
__________________________________________ Yahoo! DSL Something to write home about. Just $16.99/mo. or less. dsl.yahoo.com