on 15:28 Fri 25 Mar, Les Mikesell (lesmikesell at gmail.com) wrote: > On 3/25/2011 2:53 PM, Dr. Ed Morbius wrote: > > > > My concern with buffering / blocking output has more to do with some > > critical service saying "wups, no more serving until I can flush my log > > buffers" than it does losing a few lines of logging periodically (though > > that should also be minimized). > > Does this have to be centralized in realtime? It'd be nice / helpful / useful. We're at the point now where syncing daily will exceed local storage allocations soon with projected growth rates. We could do more frequent log rotation / distribution, but given the role and volume, real-time (or very close to it) updates would be preferred, and workfactor is largely orthogonal. If we need to queue, we could always have rsyslog (we're using it, not syslog-ng) write locally and rotate those frequently. There's still the risk of a hiccup between nginx and rsyslog, but we can keep an eye on that via monit. -- Dr. Ed Morbius, Chief Scientist / | Robot Wrangler / Staff Psychologist | When you seek unlimited power Krell Power Systems Unlimited | Go to Krell!