On Fri, 30 Jan 2004, Darek M wrote:
> Hi Ulric,
>
> I send this email to the mailing list, but noticed that the last
> majordomo archive was done in Nov. Is the mailing list closed?
Not intentionally. ;-) I changed from sendmail to postfix and apparently
hypermail didn't like it.
> I pasted below the last 2 lines of two logs that I have (same log, just
> one was copied to a different filename).
>
> The client, who has access to the logs, initially thought the logging
> crashed. Then thought it was somehow "buffered."
The second thought is correct. The output from penlogd is block buffered
for performance. You can use the -b option to change it to line buffered,
but it is IMHO better to make penlogd flush the buffer by sending it a
HUP signal when you want to look at the logs. That way you only pay the
performance penalty once, not for every line. The only time -b makes sense
is for running tail -f on the file.
> My guess would be that UDP traffic was lost somewhere and no attempt was
> made to resend it (the nature of UDP). Seems that a lot of data goes
> over the wire at once, and penlogd discards some of it. You must have
> seen this in the past so I'd prefer to get some insight from an
> authoritative source, rather than my guess, when talking to the client.
Even if some udp traffic was lost, it would result in missing lines from
the log, not truncated ones. This is on purpose so that the web servers
aren't held up waiting for the logs to be written.
In my experience, udp on a fast lan is pretty reliable, and I have never
seen penlogd lose logs due to heavy traffic.
Ulric
This archive was generated by hypermail 2.1.2 : Sun Feb 01 2004 - 01:44:17 CET