syslog-ng to replace syslogd

[Russell Coker]

On Sun, 22 Aug 2004 03:21, Iago Rubio <iago.rubio at hispalinux.es> wrote:
> On Sat, 2004-08-21 at 13:30, Russell Coker wrote:
> > On Sat, 21 Aug 2004 17:49, Iago Rubio <iago.rubio at hispalinux.es> wrote:
> > > ITOH it's buffered architecture make it really bad for developers or
> > > kernel debuggers as log messages does not arise instantly, but when the
> > > buffer is big enought to write it out (the buffering can be disabled).
> >
> > How is this different from the regular syslogd?
>
> Well, syslogd will flush out any input "instantly", so it's easier to

Not if you use option "-".

> > I have configured lots of machines with the "-" option on all log files
> > to use buffering and reduce IO load.  I haven't found any great problems
> > with that, often a kernel bug will break even non-buffered disk IO...
>
> I agree with you.
>
> I'm just pointing that some users and developers will find surprising
> that log messages does not appears instantly. I'm sure someone will be

Why will they be surprised?  We have two syslog programs which can be 
configured to buffer log data or write it synchronously.  Making them both 
have the same default in this regard is trivial.

The choice of which syslogd to use is independent of the choice of whether to 
use buffering.

FWIW I think that we should buffer all logs other than auth.log and kern.log 
(which would only have the higher priority kernel messages to have a better 
chance of getting Oops messages before things really die).

In most cases synchronous writes for logs just reduces performance for no 
benefit.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page