On Tue, 23 Feb 2010, Rory Toma wrote: > I would like several front end servers writing to a single file-system, but I > would expect that, out-of-the-box I would get out of order files and would > have locking issues.
Yes, if you use a standard filesystem you can only have one system writing to it at a time. If you want multiple systems to be able to write to a single filesystem you need to select a cluster filesystem or a network filesystem such a filesystem will allow multiple machines to write to different files on the shared filesystem at once, but they cannot write to the same file from different machines. all of the options have very different performance, reliability, and cost trade-offs. You will need to spend a lot of time thinking though your particular requirements and the capabilities of the different systems to pick one. I'm not sure exactly what you mean by 'out of order files', but if you are thinking that everything would end up in the same file and be in a different order than they were 'really' generated, then you are correct. The problem is that packets going over the network may not arrive in the same order that they were sent. Thus it is impossible for any system to guarantee the log entries reamin in the same order. the best that anything can do it to record very accurate timestamps and re-sort the logs after they have arrived. Very few people go down this road for logs. Almost everyone relays the logs to a single server and lets that server write to a filesystem (and if they need to eliminate this as a single point of failure, they make another system able to take over this filesystem if the first one goes down) David Lang > On 2/23/10 4:10 PM, [email protected] wrote: >> On Tue, 23 Feb 2010, Rory Toma wrote: >> >> >>> On 2/23/10 3:37 PM, Rory Toma wrote: >>> >>>> Has anyone used amazon s3 (or ec2) for collecting/storing logs yet? >>>> _______________________________________________ >>>> rsyslog mailing list >>>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>>> http://www.rsyslog.com >>>> >>>> >>> Or, generically, how would I take a group of rsyslog servers accepting >>> logs and have them log to central storage, without using a single >>> central logger, and preferably, not using SQL injection. >>> >> so you want the logs send to a central place but not to a central logger. >> >> what's the difference? >> >> as a security person SQL injection is a exploit of badly written code, not >> something anyone would ever want to use, so I don't understand what you >> are asking here. >> >> David Lang >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com >> > > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
