Perhaps if you are writing to a file that happens to be remote via NFS? With async, the local filesystem buffer will report to rsyslog that it completed the write successfully, but after that point the write via NFS may fail, and now rsyslog will never know those messages never actually made it to disk on the remote box..?
-- Dave Caplinger, Director of Architecture | Ph: (402) 361-3063 | Solutionary — An NTT Group Security Company On May 6, 2014, at 6:23 AM, Rainer Gerhards <[email protected]> wrote: > Sent from phone, thus brief. > Am 06.05.2014 11:36 schrieb "Thomas D." <[email protected]>: >> >> Hi, >> >> Rainer Gerhards wrote: >>> Besides, at least on a busy system, syncing is counter-productive. While >>> what is on the disk stays on the disk, the in-memory queue fills up more >>> rapidly. So in many use cases, activating sync potentially causes *more* >>> message loss. >>> >>> [...] >>> >>>> Would you still recommend to enable syncing for important files like >>>> "/var/log/auth.log" or not? >>> >>> see above: definitely no >> >> Interesting. >> >> Just for my understanding: Could you describe a typical use case when >> you would definitely want to set "Sync = on" for an action? Actual it >> sounds like that there's never a reason... > > I don't know one. Anyone else? > > Rainer >> >> Thanks! >> >> >> -Thomas >> >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
