[syslog-ng] Buffering AF_UNIX Destination, Batch Post Processing Messages

Balazs Scheidler bazsi at balabit.hu
Sun Sep 12 17:58:56 CEST 2010


On Tue, 2010-09-07 at 19:25 -0600, syslogng at feystorm.net wrote:
> Syslog-ng already has the exact functionality you are looking for (at
> least as far as I understand what youre wanting). Create a udp
> destination driver, set flush_timeout to 60000 (60 seconds), and
> flush_lines to 0 (the default). Syslog-ng will queue all the
> destination messages until the oldest message is 60 seconds old, and
> then flushes them all out at once.
> 

The idea is great, however flush_timeout() only kicks in if
flush_lines() is non-zero, but increase it to a large value.

Also, I'd use a unix-dgram() destination not an udp() one to avoid
losing messages.

-- 
Bazsi




More information about the syslog-ng mailing list