[syslog-ng] suitability of syslog-ng with long messages

[Joe Shaw]

Hi,

I am working on a project in which we will have many gigabytes of data
logged per day.  The log producers themselves were mostly developed in
house and presently are simply logging to a file, but as we build out
the system we'll obviously need some centralization.  I've been
thinking about using syslog-ng for this.

While most of the messages are relatively small -- on the order of
hundreds of bytes or a couple kilobytes -- there are some exceptional
cases where we are generating messages that could be as large as two
megabytes and need these to be kept in tact.

We'll be using the tcp() destination driver.  Are there any
performance considerations, gotchas, etc. in setting
log_msg_size(2097152)?  Would that have a bad interaction memory
usage-wise, for example, with log_fifo_size() if it were set to 1000?
I am trying to get a feel if syslog-ng is the right tool for the
problem here, or if something else would be more suitable.

Thanks for any info you can provide,

Joe