On Mon, 2006-10-30 at 19:29 +0000, Hari Sekhon wrote:
I'm not entirely clear on the whole dropping thing in syslog-ng.
If messages are dropped, I take it this does not affect other destination sources, they still get their messages, right?
Also, I remember reading on campin.net's faq that if the logger fills up the global buffer due to one destination not being available, then you effectively lose all buffering. I take it this is what will happen to my local logger if I stop running root-tail for any reason, ie my X session dies or something... Is this what you mean by dropping messages internally? They overflow the global buffer and then are immediately discarded if the destination can't accept them?
the buffers are not global, in fact no global buffer exists. There's a per-destination buffer however, only the dropped counter is global (at least in 1.6.x)
Which brings me to another point. How exactly do you specify different global buffers, as recommended at the bottom of the campin.net faq? It doesn't explicitly say how to do this. Does having separate destination definitions do this or is some other configuration needed?
If I read the FAQ correctly Nate refers to system architecture and not syslog-ng architecture. He says that instead of using a single pipe to distribute messages to multiple components, use a pipe for each component. For syslog-ng, every destination has its own buffer, the size of this buffer can be set globally (e.g. the same for all destinations), or locally, but whereever you set the buffer size, the buffer will always be there for each destination. -- Bazsi