Syslog

[dlang]

The performance of syslog depends heavily on what implementation you are
using. For example, rsyslog has been measured at 1M logs/sec under ideal
conditions (and I've used it at over 100K logs/sec). rsyslog is now the
default syslog on just about every linux distro. This isn't like the old
sysklogd that was could only process one message at a time and blocked
everything until it finished processing the message (limiting it to a
few hundred logs/sec, even on really good disks)

I can understand why you would not want to make logging to syslog be the
default, but why are you so opposed to having it as an option?

yes, if the syslog daemon dies, things writing to it will block, but if
your partition that you are writing logfiles to fills up you will block
as well. Deciding how to log, and if blocking on another daemon is
acceptable should be up to the system administrator. Sometimes getting a
copy of the logs elsewhere in near real-time is worth reducing the peak
requests/sec that a box can handle

The other approach you could allow someone to submit would be to sent
the logs out in real-time via UDP, this will mean that logs are lost if
the syslog daemon goes down, but nginx won't block

David Lang

Posted at Nginx Forum: http://forum.nginx.org/read.php?2,225811,228603#msg-228603