Re: Log rotation

On Saturday 13 March 2004 10:36 am, Fernando Nasser wrote:
> The problem is that sysloging has more overhead than a plain append to a
> file.  There are some very strict response time AppServer applications
> where we want to keep this things out of the picture.

Well, I have a couple of ideas on that.  First, a better syslog.  SDSC secure 
syslog has been available for some time and is BSD licensed, and is 
specifically designed for high-performance RFC3195 compliant secure syslog.

Second, if the syslog server is separate, then you might get better 
performance as the size of the logs grow, since appending a very large file 
is slower than generating an IP datagram.

Third, it seems that you don't have enough profiling data to support a 'syslog 
is bad' position.  Java is bad too, from a performance standpoint (at this 
time, at least, you always get a performance hit of some kind using any 
portable code).  But if this AppServer is based on the ArsDigita Java 
codebase, you have other performance issues already (the Tcl codebase, OTOH, 
is very fast, partly because AOLserver is a faster appserver than most Java 
appservers).).

> The other problem is that we have some nice graphical tools for
> configuring logging but the /etc/syslog.conf is a very hard one to
> automate dur to the pattern matching.  We can add some lines there, like
> one to get local0 to a specific file, but it will probably be guesswork
> and require human inspection anyway.

Control Center looks promising.  But I much prefer having a central syslog 
server than having each server in a cluster having separate logs.

> It may be desirable to logrotate them at different times as well, so
> they would have to be in different files.

Different facilities can then go to different files.  The problem, of course, 
is syslog's limited number of facilities.  

> > Or you'll have to include some other log rotator.

> That is what Tom is proposing.

I am not opposed to including a small logrotator for stderr logging.  I just 
think it is redundant when a good highly configurable logging facility 
already exists.  But, if Red Hat wants to pay Tom to do it... :-)
-- 
Lamar Owen
Director of Information Technology
Pisgah Astronomical Research Institute
1 PARI Drive
Rosman, NC  28772
(828)862-5554
www.pari.edu