[syslog-ng] multiple source/destination setup

[Bill Nash]

On Wed, 29 Jun 2005, Kevin wrote:

> On 6/28/05, William Bell <williamb at cwie.net> wrote:
>> Here is a copy of the conf file with only the private info adjusted.
> . . .
>>         log_fifo_size(0);
> . . .
>>         sync(1);
> . . .
>
> Ouch.  With these settings, syslog-ng isn't doing any internal buffering,
> In my experience, a high-volume logger needs these two values set high,
> I use the following:
>
>        sync(256);
>        log_fifo_size(4095);
>
> With these settings, we are currently processing UDP syslog data

At one point, the configuration Will cites above was tossing 20GB per day 
through a single device, with no appreciable loss, relying mostly on the 
stock kernel send-q and rcv-q for buffering. YMMV. =)

- billn