[syslog-ng]Scaling for a central loghost ?

[Nate Campi]

On Tue, Apr 13, 2004 at 11:33:37AM -0500, Chris Josephes wrote:
> On Tue, 13 Apr 2004, Michael Arndt wrote:
> 
> > Can i take measures on client side (syslog-ng sender to avoid
> > that sent informations are dropped either client side or server side)
> 
> You might be able to use the TCP transport, which could give you better
> reliability; but the best alternative is to duplicate all syslog messages
> to a single local file.  That way you know they won't be lost.

One of these days soon I'm going to cobble something together like
socklog's tryto, but for syslog-ng.

 http://smarden.org/socklog/network.html

Basically everything is logged locally, then when the log hits a certain
size an attempt is made to transfer it to a central location. I don't
like the delay in transmission though, since it gives the possibility to
remove the logs before transmission. 

I might must move the network transmission into a simple perl script
that falls back to local logging when a TCP connection is broken, then
tries to retransmit when the connection is re-established. If the
concept works out well, maybe a real programmer could write it into
syslog-ng so that it's behavior could be controlled via syslog-ng.conf.

This feature seems like a natural direction for syslog-ng to go in, IMO
anyways.
-- 
Nate

"The percentage of users running Windows NT Workstation 4.0 whose PCs
stopped working more than once a month was less than half that of Windows
95 users."-- microsoft.com/ntworkstation/overview/Reliability/Highest.asp