24 Jul
2008
24 Jul
'08
8:58 p.m.
Chris Pratt (pratt70@gmail.com) wrote on 24 July 2008 13:10:
Followed http://www.syslog.org/syslog-ng/v2/#id2535001 and created some tail logger combos to feed some growing logfiles into syslog-ng.
Issue that I am need to get around is that while I haven't missed capturing any messages this way the time stamps in syslog-ng seem to be when logger actually gets the line into syslog rather than that of the tailed files line. I have a very quick-filling file (logged 143 messages yesterday all at 14:15:18) and when I view syslog-ng these are stamped up to 14:15:36 and no longer in any order.
I suggest you make your disk-eater write to a fifo, and syslog-ng read from it with a pipe source. I do it for apache...