[syslog-ng] Is the option flush_lines valid now?

[Scheidler, Balázs]

Flush-lines controls the maximum buffer size, but syslog-ng will
automatically flush if there's no input. So you will see one message at a
time unless messages are streaming in at a high pace.

Flush-lines used to work differently, but was changed when syslog-ng became
multithreaded.

What is your usecase where this might be needed?
On Oct 15, 2015 6:31 AM, "伊藤 宏平" <ki0412 at hotmail.com> wrote:

> Thank you for your advice.
> I tried you options.
> But the problem is same.
>
> I use options below.
>
> options {
>     chain_hostnames(off);
>     flush_lines(3);
>     flush_timeout(5);
>     use_dns(no);
>     use_fqdn(no);
>     owner("root");
>     group("adm");
>     perm(0640);
>     stats_freq(600);
>     bad_hostname("^gconfd$");
> };
>
> I try to catch log by tail command.
> like this "$sudo tail -f /var/log/messages"
>
> I expected to 3 line show at a time.
> But log shows one by one, when I call logger command.
>
> Could you confirm that the log shows at once? Or one by one?
>
> thanks!
>
>
> ------------------------------
> To: syslog-ng at lists.balabit.hu
> From: erempel at uvic.ca
> Date: Wed, 14 Oct 2015 20:01:54 -0700
> Subject: Re: [syslog-ng] Is the option flush_lines valid now?
>
> What happens when you try to use the option.
>
> I use it with syslog-ng 3.7.1
>
> options {
>         log_fifo_size(20000000);
>         use_fqdn(yes);
>         keep_hostname(yes);
>         chain_hostnames(yes);
>         time_reap(60);
>         time_reopen(5);
>         flush_lines(15000);
>         flush_timeout(2000);
>         stats_level(1);
>         log_msg_size(16384);
> };
>
>
> without any problems.
>
>
> On 10/14/2015 04:35 PM, 伊藤 宏平 wrote:
>
> I tried to use syslog-ng.
>
> At first I used a syslog-ng 3.5.3 on ubuntu14.04.
> But I can not use flush_line option.
>
> I asked question in stack overflow.
> Mr.argus said that " There is a lack of condition"
> linux - syslog-ng の flush_lines オプションが効かない - スタック・オーバーフロー
> <http://ja.stackoverflow.com/questions/12836/syslog-ng-%E3%81%AE-flush-lines-%E3%82%AA%E3%83%97%E3%82%B7%E3%83%A7%E3%83%B3%E3%81%8C%E5%8A%B9%E3%81%8B%E3%81%AA%E3%81%84>
>
> Specifically function "log_writer_flush" should be like that.
>
> Before:
>
> gboolean
> log_writer_flush(LogWriter *self, LogWriterFlushMode flush_mode){
>                        :
>
>   if (flush_mode >= LW_FLUSH_BUFFER || count == 0)
>   {
>     if (log_proto_client_flush(proto) == LPS_ER!
>  ROR)
>       return FALSE;
>   }
>
> After:
>
> LogProtoFileWriter *w = (LogProtoFileWriter *)proto;if ( (w->buf_count >= w->buf_size) && (flush_mode >= LW_FLUSH_BUFFER || count == 0) )
>   {
>     if (log_proto_client_flush(proto) == LPS_ER!
>  ROR)
>       return FALSE;
>   }
>
>
> And now I use a latest syslog-ng ose 3.7.1, hoping the bug has been fixed.
> But I can not use flush_line option either.
>
> Is the option flush_lines valid now?
>
> try (動) 試みる、努める、努力する、試す、挑む、見る、審理する
> tried (形) 検査済みの、証明済みの、試験済みの
> Powered by iKnow! <http://iknow.jp>
>
>
> This body part will be downloaded on demand.
>
>
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng FAQ:
> http://www.balabit.com/wiki/syslog-ng-faq
> advice (名) 助言、アドバイス、勧め
> Powered by iKnow! <http://iknow.jp>
>
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20151015/6f831c35/attachment.htm