[syslog-ng] zero-loss from source{pipe()}
Jon Stearley
jrstear at sandia.gov
Wed Apr 12 18:02:07 CEST 2006
manual snippet: "syslog-ng always reads its incoming log channels to
prevent the running daemons from blocking." log_fifo_size() is
offered as mitigation strategy. is there a way to force syslog-ng
not to do this - option i've missed (or undocumented), preprocessor
DEFINE, etc?
why: i want to re-bin some historical logs into a $YEAR/$MONTH/$DAY/
$HOUR/$HOST file layout. syslog-ng is configured with a source pipe
and destination as above, and fed via a fifo:
find /historical/log/dir -type f -exec cat {} /tmp/myfifo \;
but the resulting output dir is only 1/3 the size of the input dir.
syslog-ng internal() messages include:
syslog-ng[425]: Cannot open file /scratch/ptest/2005/05/13/13/sn5
for writing (No such file or directory)
syslog-ng[425]: STATS: dropped 0
"dropped 0" seems inaccurate. this continues to happen even when
log_fifo_size() is set higher than the maximum actual number of lines
in an output file (which i happen to know for this test case). i
could throttle feeding the pipe, but then it's trial-and-error to
find the zero-loss rate. is there a better way?
i'm running syslog-ng 1.6.0 on an old debian box, but since 1.6.x and
1.9.x manuals both contain the statement above i doubted an upgrade
would behave differently in this respect? so i thought i'd ask.
many thanks!
--
+--------------------------------------------------------------+
| Jon Stearley (505) 845-7571 (FAX 844-9297) |
| Sandia National Laboratories Scalable Systems Integration |
+--------------------------------------------------------------+
More information about the syslog-ng
mailing list