On Wed, 26 Feb 2014, Anwar El fatayri wrote:
Hey,At the moment, we have a centralized logging architecture which is not reliable (via Ossec) and this is why we're trying to use rsyslog - RELP instead of Ossec to reliably centralize our logs. However, we have more than 300 hosts per Datacenter that generate lots of logs. In case of any breakdown (server goes down for example), rsyslog clients will save all messages to disk ($WorkDirectory) and this could be really costly. I tried to compress spool files using logrotate. The problem is that these compressed files are not sent when the server is up again. So is it possible to compress spool files using rsyslog ?? If not, Can we configure rsyslog to decompress spool files before dequeuing ??
Right now rsyslog does not deal with compressed spool files. The feeling is that disk is cheap, and compressed files do not allow efficient random access, so we want to have uncompressed access to the data.
That said, I can see where it would be useful to be able to compress the intermediate spool files (not the one being read, not the one being written to, but any others that exist). But it's not currently implemented, and I think you are the first to ask for it.
David Lang _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
