Hi, I'm configuring syslog-ng for use on a central log server, processing logs from 60 busy syslog clients, and I've realised that without hostname macro expansion in the config file I'm going to end up with a file >600 lines long. Is this likely to cause performance problems with syslog-ng when it's trying to compare each syslog packet against this kind of filter/action list, and has anyone else used it in a similar environment? Thanks, Ger. -- Ger Mulcahy, Technical Consultant, Harvard Business School
I am doing similar here. we have about 40-50 servers,routers,nas boxes that i am logging. My config file is only 73 lines due to the fact that i am using the hostname macro expansion. I would not even want to write a config for this many servers without the macro expansion. I don't know about any limits on the size of the conf file in syslog-ng though. This is working out quite well for us. why not use the macro expansions instead of hardcoding for each host? Chris Scheller Network One Internet, inc. http://www.networkone.net/ System/Network Administration 1.888.GOT-NET1 On Wed, 8 Dec 1999, ger wrote:
Hi, I'm configuring syslog-ng for use on a central log server, processing logs from 60 busy syslog clients, and I've realised that without hostname macro expansion in the config file I'm going to end up with a file >600 lines long. Is this likely to cause performance problems with syslog-ng when it's trying to compare each syslog packet against this kind of filter/action list, and has anyone else used it in a similar environment?
Thanks, Ger.
-- Ger Mulcahy, Technical Consultant, Harvard Business School
_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu http://lists.balabit.hu/mailman/listinfo/syslog-ng
I'm configuring syslog-ng for use on a central log server, processing logs from 60 busy syslog clients, and I've realised that without hostname macro expansion in the config file I'm going to end up with a file >600 lines long. Is this likely to cause performance problems with syslog-ng when it's trying to compare each syslog packet against this kind of filter/action list, and has anyone else used it in a similar environment?
Parsing is not a problem, it's only done at startup. But having a large number of "log" statement may degrade performance a bit. The message routing part in syslog-ng is not optimized yet. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt
Balazs,
Parsing is not a problem, it's only done at startup. But having a large number of "log" statement may degrade performance a bit. The message routing part in syslog-ng is not optimized yet.
Thanks for the input - I've decided, based on information kindly provided by Chris Scheller, to go with the development source tree and use the $HOST macro, which vastly shortens the config file. Additionally, thanks for a very useful product :) Regards, Ger. -- Ger Mulcahy, Technical Consultant, Harvard Business School
participants (3)
-
Balazs Scheidler
-
Chris Scheller
-
ger