On Tue, 23 Feb 2010, [email protected] wrote: > I'm not sure exactly what you mean by 'out of order files', but if you are > thinking that everything would end up in the same file and be in a different > order than they were 'really' generated, then you are correct. The problem is > that packets going over the network may not arrive in the same order that > they were sent. Thus it is impossible for any system to guarantee the log > entries reamin in the same order. the best that anything can do it to record > very accurate timestamps and re-sort the logs after they have arrived.
By the way, if keeping the logs in order is critical to you, you need to be aware that rsyslog may not process the logs in order under all conditions. For example: if you have multiple worker threads, they each grab some logs off the queue and attempt to deliver/write them. This can cause the logs to be delivered/written in a different order than rsyslog received them. Since there are so many other things that can re-order logs slightly, this is not viewed as a significant problem. David Lang > >> On 2/23/10 4:10 PM, [email protected] wrote: >>> On Tue, 23 Feb 2010, Rory Toma wrote: >>> >>> >>>> On 2/23/10 3:37 PM, Rory Toma wrote: >>>> >>>>> Has anyone used amazon s3 (or ec2) for collecting/storing logs yet? >>>>> _______________________________________________ >>>>> rsyslog mailing list >>>>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>>>> http://www.rsyslog.com >>>>> >>>>> >>>> Or, generically, how would I take a group of rsyslog servers accepting >>>> logs and have them log to central storage, without using a single >>>> central logger, and preferably, not using SQL injection. >>>> >>> so you want the logs send to a central place but not to a central logger. >>> >>> what's the difference? >>> >>> as a security person SQL injection is a exploit of badly written code, not >>> something anyone would ever want to use, so I don't understand what you >>> are asking here. >>> >>> David Lang >>> _______________________________________________ >>> rsyslog mailing list >>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>> http://www.rsyslog.com >>> >> >> > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
