[syslog-ng] Delay writing to files

[Paolo Supino]

Hi 

  I'm not sure weather the message gets written or not to the file 
eventually (there is no specific message I was able to track) so I
cannot answer your question with absolute certainty. If I had to guess
than I'd say it does get written to the file eventually.
  I think that the problem is in the way that syslog write the messages
to the files. From what I read then on every message that  is received
a single write() is done. This means that each destination gets opened
and closed repeatedly (and this was confirmed by running `fuser` on
each of the files). On my server there are a few destinations (the ones
that belong to the firewalls) that are so busy that they are constantly
open or are opened/closed in such a pace that it's impossible to track
manually. Might it be that in such a scenario messages will 1st be
written to a destination that is already open and messages to
destinations that are closed will wait an undefined amount of time? 
  Is there a way I can track what happens with a specific message in
syslog-ng? 




TIA 
Paolo 



--- Balazs Scheidler <bazsi at balabit.hu> wrote:

> On Mon, 2005-12-26 at 03:14 -0800, Paolo Supino wrote:
> > Hi 
> > 
> >   Here is an update on the interval in writing to the log file: 
> > the output of ls -l on the file: 
> > -rw-r--r--  1 root root 6234 Dec 26 08:03 switch-01.log
> > and the last messsege coming in on the NIC (captured by tcpdump): 
> > 12:56:57.564348 IP switch-01.1024 > syslog.hot.net.il.syslog: UDP,
> > length 75
> >  As you can see the time interval is almost 5 hours... :-( 
> > 
> 
> I can't see how this could happen, log_fifo_size only specifies the
> maximum size of the buffer and does not increase write latency on its
> own.
> 
> Does the message arrive to the destination at the end? Because if it
> is
> not then probably it is an unrelated issue. The only thing that
> affects
> write latency is sync()
> 
> -- 
> Bazsi
> 
> _______________________________________________
> syslog-ng maillist  -  syslog-ng at lists.balabit.hu
> https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Frequently asked questions at
> http://www.campin.net/syslog-ng/faq.html
> 
> 



		
__________________________________________ 
Yahoo! DSL – Something to write home about. 
Just $16.99/mo. or less. 
dsl.yahoo.com