[syslog-ng]Apache Access Log Load and Syslog-ng Stability

[Kevin]

On Thu, 10 Mar 2005 21:09:18 -0600, Jason Stafford <jason@dpcomm.net> wrote:
> I'm trying to setup a load balanced system with several web servers and one
> central log server. Currently I have syslog-ng running and pipe the output
> form apache to logger. This is all running locally on one box.  However,
> syslog-ng just randomly hangs and apache stop processing requests.

This sounds like an issue with the pipe.  If you move the logger off-box and
switch to UDP, you won't have the problem with Apache hanging, if the remote
logger dies, then you just won't have log data.

> I can restart apache and it still does not respond, but i can just restart
> syslog-ng and then it all starts working again.  Is syslog-ng designed to
> handle this kinda of load, around 3 million entries a day?

I have a central logger doing 5 million entries an hour, so I'd say yes,
syslog-ng can handle this load :)

What sources does syslog-ng accept from on the central logger?
TCP? UDP? both? local socket/pipe?

I've never used syslog-ng with a local log socket or pipe.


> I have been googling for hours and can only find some comments
> about log_fifo_size and reap_time in the options section?  

Currently I have the following:
       sync(256);
       log_fifo_size(4095);
       time_reap(300);
       log_msg_size(2048);


> here is my current config, if that helps any
>  
> options { sync (0);
>           time_reopen (10);
>           log_fifo_size (1000);
>           long_hostnames (off);
>           use_dns (no);
>           use_fqdn (no);
>           create_dirs (no);
>           keep_hostname (yes);
>         };
. . .
> httpd.conf log line
> CustomLog "|/usr/bin/logger -p local0.info -t APACHE_ACCESS_LOG" tracking

I do not recall if this is the recommended way to have apache log to syslog?


Kevin