[syslog-ng] Delay writing to files

[Paolo Supino]

Hi Nate 

  Here is the tcpdump output: 
09:18:34.047104 IP switch-01.1024 > syslog-server.syslog: UDP, length
73
 the current clock on the syslog server is: 09:27:09 (as printed by
date).
Here is the output destination of file `ls -l` output:
-rw-r--r--  1 root root 6234 Dec 26 08:03 switch-01.log

  This server is also the syslog server for some very chatty checkpoint
firewalls that send all their logs to it and I feel the syslog-ng fails
to be up to speed because of them (didn't try to turn them off yet). 




TIA 
Paolo 

PS - The time now is alerady 09:31:29 and the file wasn't written yet
(though new messages were sent to it). 



  

--- Nate Campi <nate at campin.net> wrote:

> On Sun, Dec 25, 2005 at 11:15:18PM -0800, Paolo Supino wrote:
> > 
> >   Thanx Nate. But for some reason sync doesn't do it in my
> > configuration. I have the following global section in my
> configuration:
> > options { sync (0);
> >           time_reopen (1);
> >           log_fifo_size (999999);
> >           long_hostnames (yes);
> >           use_dns (yes);
> >           dns_cache(yes);
> >           dns_cache_size(1000);
> >           dns_cache_expire(604800);
> >           use_fqdn (yes);
> >           create_dirs (yes);
> >           keep_hostname (yes);
> >         };
> >  and still messages are written in delay to the files:
> 
> What kind of delay are we talking about here? I'd think that the only
> remaining cause of delay isn't syslog-ng but the OS and/or your C
> libraries, but maybe something weird is going on.
> -- 
> Nate
> 
> "If you torture the data enough, it will confess."    ~ Ronald Coase.
> 
> 
> _______________________________________________
> syslog-ng maillist  -  syslog-ng at lists.balabit.hu
> https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Frequently asked questions at
> http://www.campin.net/syslog-ng/faq.html
> 
> 



	
		
__________________________________ 
Yahoo! for Good - Make a difference this year. 
http://brand.yahoo.com/cybergivingweek2005/