Syslog-ng?

[Anton Yuzhaninov]

On 11/27/12 16:57, Rafał Radecki wrote:
> I am currently deploying an evnironment with nginx webservers. I would like to
> store logs centrally with syslog-ng. I would like to make it as efficient as it
> can be, I've found two "howtos":
> http://pastebin.com/PCYtve9s
> http://grokbase.com/t/centos/centos/113ryagfqe/remote-logging-nginx-or-other-non-syslog-enabled-stuff (Ilyas's
> responses)
> which use fifos.
>
> What do you think about using fifos? Is it more efficient than logging
> to/through a file? What about sockets? Are there any other alternatives? What
> are your experiences?

Writing logs from nginx to fifo is bad idea.

If you need efficient logging on loaded server write log to file.

1. file can be rotated as often as need, and moved to dir accessible by rsync.
2. files from this dir can be rsync-ed to central server.

If your need near-real time logs on central server (several minutes lag is not 
acceptable) try add something like this to syslog-nd config:

source nginx_access { program("tail -F -n0 /var/log/nginx/access.log"); };

But it will be less efficient and less reliable - some messages can be lost at 
syslog-ng restarts, central log server reboot e. t. c.

-- 
  Anton Yuzhaninov