Hi, it depends on how much logdata you are going to view and search with LogAnalyzer. For example on single Servers where you want to do some quick searches through daily logs (like mail.log), it can be fully sufficient to use file logging. We are using LogAnalyzer this way on our postfix gateways when we search for missing mails or failures.
For any usage above this, I would recommend to use a MSQL database for the logdata. It will improve search speed. However you may need to clean up the database from time to time, a database with millions of log entries will become slow at some point. Best regards, Andre Lorbach > -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of Sivan Greenberg > Sent: Sonntag, 21. November 2010 16:32 > To: rsyslog-users > Subject: [rsyslog] logAnalyzer best practice > > Hi list, again :) > > I would like to know if it is best to feed loganalyzer through a mysql storage > or filesyste, files? > > It seems to me, that using mysql could be better for log view performance, > e.g. since mysql supports proper indexing and free text search? Anybody > have any experience with something similar? > > I would like to have the log analyzer have the best setup scenario for quick > search and analysis. also I would like to know, if using flat files, it is using > indexes and the like for better searches and real time analysis? (I'm asking as > I'm going to set what's best for logAnalyzer and then follow suite to adopt > the rest of the infrastructure accordingly) > > Many thanks, > > -Sivan > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
