[syslog-ng] suitability of syslog-ng with long messages

[Balazs Scheidler]

On Tue, 2008-06-24 at 10:32 -0400, Joe Shaw wrote:
> Hi,
> 
> Thanks for the info!
> 
> On Tue, Jun 24, 2008 at 3:30 AM, Balazs Scheidler <bazsi at balabit.hu> wrote:
> > The other question is FIFO size, like you mentioned. The worst case
> > scenario is that need have 2MB * log_fifo_size() memory for each
> > destination. It is currently not possible to limit fifo size by bytes,
> > and setting the fifo size to a low value can cause problems when network
> > is down.
> 
> The worst case is 2MB * log_fifo_size(), but in an ordinary case where
> only some data is being buffered, and the messages are smaller than
> 2MB messages, are 2MB buffers still being allocated?  To put it
> differently, is a buffer of log_msg_size() always allocated for the
> cached messages regardless of size, or only for the actual size of the
> message?

Of course only the actual size is allocated.

> 
> > The disk based buffering in the Premium Edition could help
> > though (in that case a small number of messages are stored in memory the
> > rest goes to disk).
> >
> > All in all, I'd wait for the framed transport with the next syslog-ng
> > version and maybe would use the Premium Edition if budgets allow that.
> 
> How long until the next version? ;)

I'm working on the final parts, but I made the same mistake as with
syslog-ng OSE 2.1, instead of doing GPLd things in public I was doing
them in my private branch, simply because I was too lazy to maintain two
branches during development.

The framing stuff is ready, it is at the QA people right now, so the
next version is coming Real Soon Now. :)

-- 
Bazsi