On Mon, 24 Oct 2011, Andreas Piesk wrote:
On 18.10.2011 20:06, Andreas Piesk wrote:
On 18.10.2011 08:39, Rainer Gerhards wrote:
Indeed and that is another story. Of course, that should not be blocked.
Trying to dig deeper into the issue: what happens if you do not monitor the
file but just use syslog() input. Does it then block?
no, without any file monitors it does not block.
even if i have a file monitor configured but do not write into the monitored
file is does not block.
the bad news: the message order changes when the backlog is transferred to the
logserver.
the order of syslog messages is not maintained. Even in the simplest, most
generic case it is possible for the network packets to pass one another
between the source and the destination.
rsyslog used to put a lot more effort into maintaining the order of the
logs, but it turns out that this effort was slowing things down
significantly, and still couldn't provide the guarantee that it was
assuming was needed.
As a result of that discussion, many new features have been implemented in
rsyslog that have provided very significant speedups, but they also
provide more ways that the logs can get out of order.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
