[syslog-ng] syslog-ng 2 and bandwidth limiting

[Balazs Scheidler]

On Fri, 2007-04-06 at 06:11 -0400, Jim Hendrick wrote:
> Thanks for the response. I am not familiar enough with the overall
> architecture to know where to look to implement something like this (nor
> have I written any significant code in several years).
> 
> Does the message flow create a separate network connection for each
> 'destination' or would it be at the 'log' level?

Each and every destination network connection has a separate queue. No
other queueing is done inside syslog-ng. (e.g. tcp driver has one, which
is kept when the connection is broken)

> 
> Does it maintain a separate buffer (queue) at the destination level or log
> level?

per-destination, multiple log statements can refer to the same
destination.

> I was thinking that one feature that would probably make this more useful
> would be an internal (or local) alert message related to bandwidth.
> Something like if the bandwidth exceeds the cap for a given destination send
> an alert message (once per time interval).
> 
> That way you would know (downstream) that log messages were (possibly) being
> lost, or at least that a bandwidth condition had been reached.

There is currently a "log statistics" message that reports various
counters, among others it has a 'dropped' counter for every destination.

-- 
Bazsi