[syslog-ng] Buffering AF_UNIX Destination, Batch Post Processing Messages

[Balazs Scheidler]

On Wed, 2010-09-29 at 08:35 -0500, Martin Holste wrote:
> > Yes. The problem with this, that there's no such thing as
> > rollover. :( syslog-ng keeps expanding the template string to find out
> > which files to write and then times out files that do not get written to
> > after time_reap() seconds.
> 
> Ok, then can then code that times out files after time_reap() be the
> trigger?  It wouldn't be immediate, but it should be soon after and
> guaranteed not to have follow-up data, right?

except if you have sparse log data during the interval. time_reap() may
close a file within the same hour if the $HOUR macro is used in the
filename. (for example 1 message every 5 minutes and time_reap() set to
60 seconds, it'll be closed quite a number of times).

-- 
Bazsi