[syslog-ng] Using tail option

[Balazs Scheidler]

On Fri, 2009-02-13 at 13:36 -0500, James B Horwath wrote:
> 
> All: 
> 
> This question refers to syslog-ng 2.0.10 running on AIX. If I use a
> global syslog-ng client file and define 2 text files that do not exist
> on every system. 
> 
> What happens when syslog-ng is run on a system that does not contain
> the files?  Does it report errors, have performance problems? 
> 
> Example: 
> 
> source s_tail1  { file("/var/apache/log/access_log" follow_freq(1)
> flags(no-parse)); }; 
> source s_tail2  { file("/var/apache/log/error_log" follow_freq(1)
> flags(no-parse)); };

If follow_freq() is set, the non-existance of files is not a fatal
error. syslog-ng will periodically check whether the file was created in
the meantime and start tailing it once it becomes available.

The overhead is one stat() call per poll iteration, and that the
follow_freq() option makes syslog-ng to wake up for a poll iteration at
least once per second.

It shouldn't have a measurable performance impact if the files are not
there.

-- 
Bazsi