[OT]: Syslog issues?
djk at tobit.co.uk
Wed Mar 21 15:43:28 GMT 2007
Luis Motta Campos wrote:
> Dear M[ou]ngers
> I'm facing a funny problem at work.
> We have a very busy apache farm producing 40Gb of log files everyday,
> and no centralized logging facility.
> We're considering using syslog (or better, syslog-ng) to concentrate
> all logs on a single spot, so we can handle, parse, and summarize all
> information for human and machine consumption.
Don't think any of the syslog daemons could reliably handle that sort of
data. Remember that syslog's job is to try to store important messages
that might allow you to diagnose a problem. Therefore they use slow disc
writing methods (syncing etc) to make sure that stuff is written.
Syslogd isn't expected to handle 40Gb/Day (~500KBytes or ~2250 lines per
On some machines that would constitute a DoS attack!
More information about the london.pm