Is there a way to define message priority for syslog-ng?
Hi, Please avoid using HTML on this mailing list. wrt your question, the answer is no. Messages are always processed in order. Changing the message order might cause problems during log analysis. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1
On 2002-04-01 09:43:24 -0500, Antai Ning wrote:
Here is my question, can syslog-ng handle syslog messages based on priority?
My application is capturing syslog messages from multiple network devices and tcp those relevant to another program to process them. Since all the messages are put in an output queue, urgent messages still have to wait their turn to be sent out which is very slow sometime. I just wandering if there is a way to configure syslog-ng to process syslog on a priority bases.
You can put them on different "queues" (pipes, TCP/UDP-Sockets, ...) based on priority. This will allow syslog messages with higher priority to "overtake" messages with lower priority, but only if no queue actually fills up. If syslog-ng blocks trying to write on any queue it will block as a whole (using TCP for high-priority queues and UDP for low-priority queues might mitigate this). hp -- _ | Peter J. Holzer | |_|_) | Sysadmin WSR | In case of emergency break laws of physics. | | | hjp@hjp.at | __/ | http://www.hjp.at/ | -- Stephen Baxter
On Mon, Apr 01, 2002 at 06:36:01PM +0200, Peter J. Holzer wrote:
On 2002-04-01 09:43:24 -0500, Antai Ning wrote:
Here is my question, can syslog-ng handle syslog messages based on priority?
My application is capturing syslog messages from multiple network devices and tcp those relevant to another program to process them. Since all the messages are put in an output queue, urgent messages still have to wait their turn to be sent out which is very slow sometime. I just wandering if there is a way to configure syslog-ng to process syslog on a priority bases.
You can put them on different "queues" (pipes, TCP/UDP-Sockets, ...) based on priority. This will allow syslog messages with higher priority to "overtake" messages with lower priority, but only if no queue actually fills up. If syslog-ng blocks trying to write on any queue it will block as a whole (using TCP for high-priority queues and UDP for low-priority queues might mitigate this).
syslog-ng will not block on TCP destinations. it fetches messages and sends them on to the buffers of different destinations, and flushes those buffers when appropriate (e.g. the socket becomes writable) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1
On 2002-04-02 09:03:48 +0200, Balazs Scheidler wrote:
On Mon, Apr 01, 2002 at 06:36:01PM +0200, Peter J. Holzer wrote:
If syslog-ng blocks trying to write on any queue it will block as a whole (using TCP for high-priority queues and UDP for low-priority queues might mitigate this).
syslog-ng will not block on TCP destinations. it fetches messages and sends them on to the buffers of different destinations, and flushes those buffers when appropriate (e.g. the socket becomes writable)
Nice. What happens if the sockets stays unwritable for a long time? Does the buffer grow indefinitely or are messages thrown away when it becomes full resp. reaches a maximum size? hp -- _ | Peter J. Holzer | |_|_) | Sysadmin WSR | In case of emergency break laws of physics. | | | hjp@hjp.at | __/ | http://www.hjp.at/ | -- Stephen Baxter
On Tue, Apr 02, 2002 at 11:45:09PM +0200, Peter J. Holzer wrote:
On 2002-04-02 09:03:48 +0200, Balazs Scheidler wrote:
On Mon, Apr 01, 2002 at 06:36:01PM +0200, Peter J. Holzer wrote:
If syslog-ng blocks trying to write on any queue it will block as a whole (using TCP for high-priority queues and UDP for low-priority queues might mitigate this).
syslog-ng will not block on TCP destinations. it fetches messages and sends them on to the buffers of different destinations, and flushes those buffers when appropriate (e.g. the socket becomes writable)
Nice. What happens if the sockets stays unwritable for a long time? Does the buffer grow indefinitely or are messages thrown away when it becomes full resp. reaches a maximum size?
you can control the buffer size using log_fifo_size(<numberofmessages>), by default it contains 100 messages. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1
participants (4)
-
Antai Ning
-
Balazs Scheidler
-
Peter J. Holzer
-
Peter J. Holzer