12 Sep
2010
12 Sep
'10
4:58 p.m.
On Tue, 2010-09-07 at 19:25 -0600, syslogng@feystorm.net wrote:
Syslog-ng already has the exact functionality you are looking for (at least as far as I understand what youre wanting). Create a udp destination driver, set flush_timeout to 60000 (60 seconds), and flush_lines to 0 (the default). Syslog-ng will queue all the destination messages until the oldest message is 60 seconds old, and then flushes them all out at once.
The idea is great, however flush_timeout() only kicks in if flush_lines() is non-zero, but increase it to a large value. Also, I'd use a unix-dgram() destination not an udp() one to avoid losing messages. -- Bazsi