the configure file as follows:
options {
use_dns(no); create_dirs(yes);ts_format(iso); };
#options {
log_fifo_size(3000); };
source src {
udp(ip(
filter f_kern
{ facility(kern); };
filter
f_authpriv { facility(auth,authpriv); };
filter f_mail
{ facility(mail); };
filter f_cron
{ facility(cron); };
filter f_boot
{ facility(local7); };
filter
f_spooler { facility(uucp, news) and level(crit..emerg); };
filter
f_messages { level(info..emerg) and not facility(authpriv, cron, mail); };
destination
kern { file("/home/syslog-ng/$YEAR/$HOST/kernel-$MONTH"); };
destination
authpriv { file("/home/syslog-ng/$YEAR/$HOST/secure-$MONTH"); };
destination
mail { file("/home/syslog-ng/$YEAR/$HOST/maillog-$MONTH"); };
destination
cron { file("/home/syslog-ng/$YEAR/$HOST/cron-$MONTH"); };
destination
boot { file("/home/syslog-ng/$YEAR/$HOST/boot.log-$MONTH"); };
destination
spooler { file("/home/syslog-ng/$YEAR/$HOST/spooler-$MONTH"); };
destination
messages { file("/home/syslog-ng/$YEAR/$HOST/messages-$MONTH"); };
log {
source(src); filter(f_kern); destination(kern); };
log {
source(src); filter(f_authpriv); destination(authpriv); };
log {
source(src); filter(f_mail); destination(mail); };
log {
source(src); filter(f_cron); destination(cron); };
log {
source(src); filter(f_boot); destination(boot); };
log {
source(src); filter(f_spooler); destination(spooler); };
log {
source(src); filter(f_messages); destination(messages); };
syslog-ng
receive logs from about 1000 clients ,and the usage of mem by syslog-ng keeps
growing,here are a days record of the usage of mem(got by command ‘ps aux’):
cup %mem
0.1 29.9
0.1 30.1
0.1 30.3
0.1 30.5
0.1 30.7
0.1 30.9
0.1 31.1
0.1 31.2
0.1 31.4
0.1 31.6
0.1 31.9
0.1 32.1
0.1 32.3
0.1 32.4
0.1 32.6
0.1 32.8
0.1 33.0
0.1 33.2
0.1 33.4
0.1 33.5
0.1 33.8
0.1 33.9
0.1 34.1
0.1 34.3
0.1 34.5
0.1 34.6
0.1 34.9
0.1 35.0
0.1 35.2