Hi Scott, [snip]
> What sort of buffer does rsyslog use? How often does that buffer > fill up and write to disk? I only ask because sometimes we tail > logfiles in real time to watch things like DHCP etc as they happen. > > If the log is 30 seconds behind that may cause a problem. I suggest you first have a look at: http://rgerhards.blogspot.com/2007/08/why-is-rsyslog-multi-threaded-and- is-it.html The bottom line with the current release is that there is no specific "output file buffer" - rsyslog writes to the OS and it buffers. Works pretty well for rapidly incoming traffic. What we do, however, is have a buffer between messages received and processed. This is primarily meant for taking care of either a) message bursts or b) temporarily slow outputs (e.g., initial database connection). If you don't like that buffer, you can limit it via rsyslog.conf (the default is 10,000 messages max). With rsyslog v3, there will be a more complex threading scheme and also some more buffers. I can also envision it will support buffered writes, enhancing the IO throughput for files (e.g. write in 64K chunks or every n (milli)seconds, whatever comes first). I am currently in the early stages of v3, but it will be a very exciting release. And I of course appreciate feedback from demanding environments (hint, hint ;)). But v3 will never hold messages longer than a) absolutely necessary or b) configured by operator. There is a good post on v3 right on the main page of my blog. I hope that clarifies, if not, please let me know. Rainer _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog
