Pavel Kankovsky <[EMAIL PROTECTED]> wrote:
>Unfortunately, a message written to disk and erased from it before
>anyone had a chance to look at it is as good (read useless) as a message
>discarded immediately. :)
True, but a message written to disk and cycled through N log files
stands a better chance of being seen than one that never makes it to
disk. :-) And if the logs are monitored by a log watching process,
"seeing" them is guaranteed.
>The question is: do you prefer to LOSE old messages or new messages when
>you run out of space?
No, the question is: do you prefer to run out of disk space or keep
your logs under predetermined limits?
>Syslog says "new messages", cyclog says "old
>messages". I have to admit I do not understand why some people think one
>of the strategies is inherently better than the other...explanation?
Firstly, the choice is not that simple, as I explained
above. Secondly, there are a host of other reasons not to use syslog,
including performance, security, and reliability problems.
-Dave
