In message <e54865560910240757m184b0420u6b37b13948c8e...@mail.gmail.com>,
Clayton Dukes writes:
>I think the problem may be that sysread is limiting to 1024 because
>that is how the RFC defines a syslog message
While that may be the case, SEC can handle a lot more than just syslog
files. There is a -blocksize argument to SEC:
-blocksize=<io_block_size>
size of the block in bytes that SEC will attempt to read from
input files at once. Default is 1024 (i.e., read from input
files by 1KB blocks).
that can be set to increase the number of bytes read in a single
sysread call. When you have a very active log file increasing that to
slurp as many lines as possible a single read can speed up SEC
processing quite dramatically.
--
-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.
------------------------------------------------------------------------------
Come build with us! The BlackBerry(R) Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay
ahead of the curve. Join us from November 9 - 12, 2009. Register now!
http://p.sf.net/sfu/devconference
_______________________________________________
Simple-evcorr-users mailing list
Simple-evcorr-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
