[syslog-ng] Idea for streaming logs to my workstation as well as logserver

[Balazs Scheidler]

On Mon, 2006-10-30 at 19:29 +0000, Hari Sekhon wrote:
> I'm not entirely clear on the whole dropping thing in syslog-ng.
> 
> If messages are dropped, I take it this does not affect other
> destination sources, they still get their messages, right?
> 
> Also, I remember reading on campin.net's faq that if the logger fills
> up the global buffer due to one destination not being available, then
> you effectively lose all buffering. I take it this is what will happen
> to my local logger if I stop running root-tail for any reason, ie my X
> session dies or something... Is this what you mean by dropping
> messages internally? They overflow the global buffer and then are
> immediately discarded if the destination can't accept them?

the buffers are not global, in fact no global buffer exists. There's a
per-destination buffer however, only the dropped counter is global (at
least in 1.6.x)

> 
> Which brings me to another point. How exactly do you specify different
> global buffers, as recommended at the bottom of the campin.net faq? It
> doesn't explicitly say how to do this. Does having separate
> destination definitions do this or is some other configuration needed?

If I read the FAQ correctly Nate refers to system architecture and not
syslog-ng architecture. He says that instead of using a single pipe to
distribute messages to multiple components, use a pipe for each
component.

For syslog-ng, every destination has its own buffer, the size of this
buffer can be set globally (e.g. the same for all destinations), or
locally, but whereever you set the buffer size, the buffer will always
be there for each destination.

-- 
Bazsi