On Sat, 12 Jul 2014, Justin Lee wrote:
Hello List,
I noticed that local messages are passed by socket rather than
directly written to log files. The evidence is as follows:
Yes, this is how syslog works.
Since log mechanism is an important infrastructure of many programs,
it is supposed to be as fast as possible. So do we have some
configurations or settings in rsyslog which make local messages
written directly into log files without passing through socket?
actually, writing to disk can be slower than writing to a socket, so it's not
clear that it's a performance win to write to disk directly.
then you have the problem of what happens to the log. If you just write to disk,
you throw away a tremendous amount of flexibility in determining what happens to
the log.
If you send the log through the syslog infrastructure, there are a lot of things
that you can end up doing with it.
You can:
combine the logs from differnet programs into one file
split the logs from one program into multiple files
filter the logs
send the logs to a remote machine
put the logs into a database
etc.
so having your program write directly to disk is less work overall for the
system to do, but it can be slower for your application, and it's far less
flexible.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
