29 Jun
2005
29 Jun
'05
11:39 p.m.
On Wed, 29 Jun 2005, Kevin wrote:
On 6/28/05, William Bell <williamb@cwie.net> wrote:
Here is a copy of the conf file with only the private info adjusted. . . . log_fifo_size(0); . . . sync(1); . . .
Ouch. With these settings, syslog-ng isn't doing any internal buffering, In my experience, a high-volume logger needs these two values set high, I use the following:
sync(256); log_fifo_size(4095);
With these settings, we are currently processing UDP syslog data
At one point, the configuration Will cites above was tossing 20GB per day through a single device, with no appreciable loss, relying mostly on the stock kernel send-q and rcv-q for buffering. YMMV. =) - billn