No subject
Sun Oct 3 12:43:47 CEST 2010
Client:
log_iw_size >= SOURCES_PER_CLIENT * log_fetch_limit
eg 35 * 10 = 350
log_fifo_size >= SOURCES_PER_CLIENT * log_fetch_limit
eg 35 * 10 = 350
AND
log_fifo_size >= SOURCES_PER_CLIENT * log_iw_size
eg 35 * 350 = 12250
So it appears to me that setting log_fifo_size to > 12250 would be correct.
Loghost
Less idea about this, do I need:
log_iw_size >= NUMBER_OF_CLIENTS * log_fetch_limit ( * SOURCES_PER_CLIENT ? )
eg 40 * 10 * 35 = 14000
And log_fifo_size >= log_iw_size ?
Is flow control important between the network source and the mysql dests?
Further information:
* Some of the larger logfiles output ~ 4 lines/sec
* Approx 4G aggregate logs generated over 14 hours by the 40 hosts
* Reliability is more important than speed - these logs are not
analysed in real time. That said, the client should have to spend
hours completing the log transfer once its workload has been
processed..
Again, apologies for the length of the post and many thanks in advance
for any help.
Ben Tisdall
PhotoBox
More information about the syslog-ng
mailing list