Logging to pipe

[Ed W]

Marlon de Boer wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Joe Van Dyk wrote:
> | Hi,
> |
> | I'd like to use syslog-ng for centralized logging.  I looked through
> | the archive and found that the reason that logging to a device or pipe
> | not being supported is because of speed concerns (too slow).
> |
> | How slow is it?  If I create a pipe with mkfifo and then write my
> | nginx logs to it, is performance going to be terrible?
> |
> | Joe
> |
> We used the named pipes for a while in our setup. I saw syslog using 
> up 30% cpu time on our quadcore 1950 dells (2.6 Ghz intel) when 
> pushing them to max load.
>
> Later I wrote a patch which you can find it here 
> http://article.gmane.org/gmane.comp.web.nginx.english/5296. This patch 
> disables the use of named pipes, but performance with syslog is just 
> as bad. The bottleneck isn't nginx offcourse but syslog.

So there is no extra load on the nginx machine, just on the syslog server?

Are you using syslog-ng?  Buffering disk writes?  Any fancy filters?

There was a spread module some time back for apache:
http://www.schlossnagle.org/~george/mod_log_spread/

Looked interesting...

Any other suggestions for reliable remote logging?

Ed W