Logging to pipe

[Marlon de Boer]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Ed W wrote:
| So there is no extra load on the nginx machine, just on the syslog server?
Syslog has to run local on the machine and the 30% cpu time I measured 
while benchmarking was local while syslog was reading from /dev/log. So 
there is an extra load locally. Be aware that this 30% is restricted to 
our test and could be quite different on your hardware.
|
| Are you using syslog-ng?  Buffering disk writes?  Any fancy filters?
We are using syslog, with some filters to split the access and the error 
logging.

destination nginx_access { file("/var/log/nginx/access_log"); };
destination nginx_error { file("/var/log/nginx/error_log"); };

filter f_nginx_access { program("nginx") and level(notice); };
filter f_nginx_error { program("nginx") and level(crit); };

log { source(src); filter(f_nginx_access); destination(nginx_access); };
log { source(src); filter(f_nginx_error); destination(nginx_error); };

and something like

log { source(src); filter(nginx_access); destination(loghost); };
|
| Any other suggestions for reliable remote logging?
See syslog rules above, using tcp for the syslog loghost and clients 
should ensure that your messages always reach the loghost if you're 
network is functioning correct. Also check the load and the disk-io on 
the central logserver that it can still keep up with your clients 
sending messages.

Regards
Marlon de Boer
System Administrator www.hyves.nl
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (GNU/Linux)

iEYEARECAAYFAkhG9JYACgkQQ6KLqYkbN3eqjQCfUWnwn+6Mr1WM5QHP+VZ4scpt
RKkAnRkQQdBk6nt/G1r0zb4hKjKJBTZB
=I4i6
-----END PGP SIGNATURE-----