>As you say, >there's way too much in a busy server's access log. I'm kind of curious about this: does anyone have any numbers they'd care to share about logging rates and server log rates? How many entries/second does a busy server's access log collect? I assume they are stdio buffered so they come in approximately BUFSIZ chunks, so it's probably pretty efficient, no? Does anyone have any numbers for when syslogd begins to puke? Since it's using unix domain UDP (in general) my guess is that the failure mode would be UDP packets getting dropped on the output queue: which is system dependent. BSD systems will do it differently from STREAMs systems which will do it differently from Linux systems, etc, etc. I guess I've heard a lot of people talk about syslog bogging down under load but I've never seen any measures behind the claim; can anyone provide some hard information? I don't feel like writing a syslogd torture test - has anyone? Are we operating on hearsay? mjr. --- Marcus J. Ranum Chief Technology Officer, NFR Security, Inc. Work: http://www.nfr.com Personal: http://www.ranum.com --------------------------------------------------------------------- To unsubscribe, e-mail: loganalysis-unsubscribeat_private For additional commands, e-mail: loganalysis-helpat_private
This archive was generated by hypermail 2b30 : Tue Jan 29 2002 - 13:01:40 PST