[syslog-ng] log_fifo_size and locked tables

[Alexander Clouter]

Hi,

Rob Munsch <rmunsch at solutionsforprogress.com> [20060412 12:22:02 -0400]:
>
> Thank you!  This is a lot of good information.
> 
> Alexander Clouter wrote:
> 
> >Well it looks like you always want at least seven days of data in the 
> >database so its hard to think of an alternative method.
> > 
> >
> Seven is a number i pulled out of my - um, hat.  I'm wanting to maximize 
> the usefulness of the 'live' database of logs (using phpmysyslogng atm), 
> but i suppose seven is kind of high, isn't it?  I just want the 
> searchable-via-frontend data to be able to provide some history and 
> context if we go looking for something.
> 
> What would you suggest?
> 
To be honest, if you are indexing on the date then you could probably get 
away with as much recent historical data as you want.  Start at 14 days or 
something but if you find it overwhelming or not needed trim it.

As you are archiving all the old data you could, if you needed older data, is 
import it back in and at the next weeks clearout of old logfiles they will be 
automagically purged.

I think you should be safe with as much as you want, as long as you index :)

Cheers

Alex