No subject


Sun Oct 3 12:43:47 CEST 2010


Client:

log_iw_size >= SOURCES_PER_CLIENT * log_fetch_limit

eg 35 * 10 = 350

log_fifo_size >= SOURCES_PER_CLIENT * log_fetch_limit

eg 35 * 10 = 350

AND

log_fifo_size >= SOURCES_PER_CLIENT * log_iw_size

eg 35 * 350 = 12250

So it appears to me that setting log_fifo_size to > 12250 would be correct.

Loghost

Less idea about this, do I need:

log_iw_size >= NUMBER_OF_CLIENTS * log_fetch_limit ( * SOURCES_PER_CLIENT ? )

eg 40 * 10 * 35 = 14000

And log_fifo_size >= log_iw_size ?

Is flow control important between the network source and the mysql dests?

Further information:

* Some of the larger logfiles output ~ 4 lines/sec
* Approx 4G aggregate logs generated over 14 hours by the 40 hosts
* Reliability is more important than speed - these logs are not
analysed in real time. That said, the client should have to spend
hours completing the log transfer once its workload has been
processed..

Again, apologies for the length of the post and many thanks in advance
for any help.

Ben Tisdall
PhotoBox


More information about the syslog-ng mailing list