[syslog-ng] Logs out of control

[John Hala]

Thanks for the suggestion.

Would you use the HASH partitioning mode, and how would you cut up the partition...  by day?

-----Original Message-----
From: syslog-ng-bounces at lists.balabit.hu [mailto:syslog-ng-bounces at lists.balabit.hu] On Behalf Of Bill Nash
Sent: Friday, October 05, 2007 11:25 AM
To: Syslog-ng users' and developers' mailing list
Subject: Re: [syslog-ng] Logs out of control


Might I suggest table partitioning by date?

- billn

On Fri, 5 Oct 2007, John Hala wrote:

> Hello,
>
> I wanted to get some guidelines on how other people are controlling their syslogs with regards to I/O performance on the database side.
>
> I am running php-syslog-ng on a separate webserver and it takes a very long time to do a search and return the results.  Long time meaning 30 to 60 minutes or even longer as the logs grow.  I have indexed the database by message, but it did not help.  The I/O on the database server is just unmanageable.
>
> Possibilities that I'm looking into are getting 15K hard drives, change the RAID from 5 to 3, add more memory the controller's cache.
>
> Thanks,
> John
> _______________________________________________
> syslog-ng maillist  -  syslog-ng at lists.balabit.hu
> https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
>
_______________________________________________
syslog-ng maillist  -  syslog-ng at lists.balabit.hu
https://lists.balabit.hu/mailman/listinfo/syslog-ng
Frequently asked questions at http://www.campin.net/syslog-ng/faq.html