[syslog-ng] Is the option flush_lines valid now?
Scheidler, Balázs
balazs.scheidler at balabit.com
Fri Oct 16 13:59:18 CEST 2015
On Oct 15, 2015 11:26 AM, "伊藤 宏平" <ki0412 at hotmail.com> wrote:
>
> I'd like to tuning the output by priority.
>
> For example,
> Critical log should be shown immediately, so I set the option
flush_line(0).
> Information should not use much power, so I set the option
flush_line(100).
>
> And I want to confirm that the option flush_line is set correctly.
> So I watch the tail of messages.
>
> Now I have 2 question.
>
> 1:How can I confirm the effect of flush_line?
With recent versions of syslog-ng, flush-lines will be ignored unless the
buffer contains messages but that only happens if you already have
considerable log traffic. What is the message rate we are talking about?
By the time syslog-ng receives the message it is already woken up, so I
guess it should also finish writing the message.
But this is only my opinion I have no personal experience with tuning for
power consumption.
> 2:What number is appropriate to set flush_line to save power?
I dunno, it wasn't meant to be a power saving parameter, rather it was
meant to improve output performance.
>
> About syslog-ng 3.7.1, default value of flush_lines is 100.(I read that
somewhere)
> I think to set flush_lines to 0 with high priority log, and set
flush_lines to 100(default so do nothing) with another log.
> Is that reasonable?
Yes, this means that highprio messages will get written as soon as they
were received, even if there are further messages sitting in the output
buffer.
>
> Oops! it's three questions!
>
> ________________________________
> Date: Thu, 15 Oct 2015 08:21:09 +0200
> From: balazs.scheidler at balabit.com
> To: syslog-ng at lists.balabit.hu
>
> Subject: Re: [syslog-ng] Is the option flush_lines valid now?
>
> Flush-lines controls the maximum buffer size, but syslog-ng will
automatically flush if there's no input. So you will see one message at a
time unless messages are streaming in at a high pace.
>
> Flush-lines used to work differently, but was changed when syslog-ng
became multithreaded.
>
> What is your usecase where this might be needed?
>
> On Oct 15, 2015 6:31 AM, "伊藤 宏平" <ki0412 at hotmail.com> wrote:
>>
>> Thank you for your advice.
>> I tried you options.
>> But the problem is same.
>>
>> I use options below.
>>
>> options {
>> chain_hostnames(off);
>> flush_lines(3);
>> flush_timeout(5);
>> use_dns(no);
>> use_fqdn(no);
>> owner("root");
>> group("adm");
>> perm(0640);
>> stats_freq(600);
>> bad_hostname("^gconfd$");
>> };
>>
>> I try to catch log by tail command.
>> like this "$sudo tail -f /var/log/messages"
>>
>> I expected to 3 line show at a time.
>> But log shows one by one, when I call logger command.
>>
>> Could you confirm that the log shows at once? Or one by one?
>>
>> thanks!
>>
>>
>> ________________________________
>> To: syslog-ng at lists.balabit.hu
>> From: erempel at uvic.ca
>> Date: Wed, 14 Oct 2015 20:01:54 -0700
>> Subject: Re: [syslog-ng] Is the option flush_lines valid now?
>>
>> What happens when you try to use the option.
>>
>> I use it with syslog-ng 3.7.1
>>
>> options {
>> log_fifo_size(20000000);
>> use_fqdn(yes);
>> keep_hostname(yes);
>> chain_hostnames(yes);
>> time_reap(60);
>> time_reopen(5);
>> flush_lines(15000);
>> flush_timeout(2000);
>> stats_level(1);
>> log_msg_size(16384);
>> };
>>
>>
>> without any problems.
>>
>>
>> On 10/14/2015 04:35 PM, 伊藤 宏平 wrote:
>>>
>>> I tried to use syslog-ng.
>>>
>>> At first I used a syslog-ng 3.5.3 on ubuntu14.04.
>>> But I can not use flush_line option.
>>>
>>> I asked question in stack overflow.
>>> Mr.argus said that " There is a lack of condition"
>>> linux - syslog-ng の flush_lines オプションが効かない - スタック・オーバーフロー
>>>
>>> Specifically function "log_writer_flush" should be like that.
>>>
>>> Before:
>>>
>>> gboolean
>>> log_writer_flush(LogWriter *self, LogWriterFlushMode flush_mode)
>>> {
>>> :
>>>
>>> if (flush_mode >= LW_FLUSH_BUFFER || count == 0)
>>> {
>>> if (log_proto_client_flush(proto) == LPS_ER!
>>> ROR
>>> )
>>> return FALSE;
>>> }
>>>
>>> After:
>>>
>>> LogProtoFileWriter *w = (LogProtoFileWriter *)proto;
>>> if ( (w->buf_count >= w->buf_size) && (flush_mode >= LW_FLUSH_BUFFER ||
count == 0) )
>>> {
>>> if (log_proto_client_flush(proto) == LPS_ER!
>>> ROR
>>> )
>>> return FALSE;
>>> }
>>>
>>>
>>> And now I use a latest syslog-ng ose 3.7.1, hoping the bug has been
fixed.
>>> But I can not use flush_line option either.
>>>
>>> Is the option flush_lines valid now?
>>>
>>> try (動) 試みる、努める、努力する、試す、挑む、見る、審理する
>>> tried (形) 検査済みの、証明済みの、試験済みの
>>> Powered by iKnow!
>>>
>>>
>>> This body part will be downloaded on demand.
>>
>>
>>
>>
______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation:
http://www.balabit.com/support/documentation/?product=syslog-ng FAQ:
http://www.balabit.com/wiki/syslog-ng-faq
>> advice (名) 助言、アドバイス、勧め
>> Powered by iKnow!
>>
>>
______________________________________________________________________________
>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
>> Documentation:
http://www.balabit.com/support/documentation/?product=syslog-ng
>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>>
>>
>
>
______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation:
http://www.balabit.com/support/documentation/?product=syslog-ng FAQ:
http://www.balabit.com/wiki/syslog-ng-faq
> priority (名) 優先事項、重要なこと、優先、優先順位
> Powered by iKnow!
>
>
______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20151016/4271ea8d/attachment.htm
More information about the syslog-ng
mailing list