On Tue, 25 Oct 2011, Andreas Piesk wrote:
On 25.10.2011 07:17, [email protected] wrote:
On Mon, 24 Oct 2011, Andreas Piesk wrote:
the bad news: the message order changes when the backlog is transferred to the
logserver.
the order of syslog messages is not maintained. Even in the simplest, most
generic case it is
possible for the network packets to pass one another between the source and the
destination.
rsyslog used to put a lot more effort into maintaining the order of the logs,
but it turns out that
this effort was slowing things down significantly, and still couldn't provide
the guarantee that it
was assuming was needed.
As a result of that discussion, many new features have been implemented in
rsyslog that have
provided very significant speedups, but they also provide more ways that the
logs can get out of order.
thank you for the info.
I'm right assuming that using a disk queue would preserve the order (the
possibility of packets
passing each other on network ignored) because all messages have to go though
the queue? i know,
disk queues are not great for performance but speed is not so important for me.
the test with a disk queue is still on my list, but maybe someone can share
first-hand experience.
I think that adding disk queues increases the likelyhood of messages
getting out of order.
the packets passing each other on the network was just an example of one
way that they can get out of order, no matter how hard rsyslog tries to
keep them in order. But since they can get out of order anyway, rsyslog
stopped trying really hard to keep them in order.
for disk queues, I think that the memory part of the queue is serviced
first, and only after it's drained do the older messages from the disk
queue get sent. If I am correct, the logic behind this is that since the
disk is so much slower than memory, it's better to process the memory ones
first because if the disk ones were serviced first it's possible that you
could not process them fast enough, and therefor new messages would need
to get added to the disk queue, which sould slow processing down further,
in sort of a death spiral.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
