[syslog-ng] log statistics level

Bryan Henderson bryanh at giraffe-data.com
Sun Mar 11 18:15:03 CET 2007


>>> And here's one that's CRITICAL:
>>> 
>>>   macros.c: Internal error, unknown macro referenced
>>> 
>>> Isn't this just another error?  If a result of this is that Syslog
>>> fails completely, it would be worth an ALERT, but then the message
>>> should mention that Syslog failed completely.  CRITICAL is just for
>>> when an entire major system is in imminent danger of collapse and
>>> needs immediate attention.  I think a system could continue useful
>>> work for quite a while without Syslog service.
>Again I would think that the logging system is more important than other
>applications. System logging needs to be a guaranteed thing, afte all, isn't that
>why were using syslog-ng in the first place :-)

That still leaves the issue that this message doesn't say Syslog
service is stopping.  I don't know if Syslog does in fact terminate as
a consequence of this error, but I do know that there are about a
hundred other messages that indicate Syslog isn't logging what it's
supposed to and this is the only message I could find in all of
syslog-ng system that is CRITICAL.

>>> And in affile.c, "Destination file is too old, removing" is to me
>>> business as usual, not something someone is likely to want to respond to,
>>> so I would make it INFO.
>>> 
>
>Any time data is overwritten/removed/lost I want to know about
>it. Perhaps a warning so that if I need to I can retrieve the log
>file from backup and place it into the log archive stream.

Would you want a warning when you type an 'rm' command that data has
been lost?  How about when your log rotater purges data according to
your retention policy?  What does this message mean, anyway?  I thought
it just indicated that Syslog did what it's supposed to do.

>WARNING is something that I should know about, but isn't reporting
>that something is broken.

That's NOTICE too.  WARNING is something that might be broken, but
the message issuer can't tell.  Or might be broken soon.

-- 
Bryan Henderson                                   San Jose, California


More information about the syslog-ng mailing list