Re: Log rotation

Lamar Owen wrote:
> On Saturday 13 March 2004 10:36 am, Fernando Nasser wrote:
>
>>The problem is that sysloging has more overhead than a plain append to a
>>file. There are some very strict response time AppServer applications
>>where we want to keep this things out of the picture.
>
>
> Well, I have a couple of ideas on that. First, a better syslog. SDSC secure
> syslog has been available for some time and is BSD licensed, and is
> specifically designed for high-performance RFC3195 compliant secure syslog.
>

I hope someone in the OS group is watching it. I will ask.

> Second, if the syslog server is separate, then you might get better
> performance as the size of the logs grow, since appending a very large file
> is slower than generating an IP datagram.
>

It may be. It takes some effort to convince customers to change their
practices though. I will try to set up something like this next time we
run benchmarks and see if there is any noticeable change in the results.

> Third, it seems that you don't have enough profiling data to support a 'syslog
> is bad' position.

That is true. It is from hearsay, from people who run production
environments. It may be a belief based on old experiences though. If
someone had real up-to-date reliable numbers maybe we could use it as an
argument to the users.

> Java is bad too, from a performance standpoint (at this
> time, at least, you always get a performance hit of some kind using any
> portable code).

Actually, this is increasingly less noticeable. With just in time
compilation or pre-compiled code (like with GNU gcj) it is a one time
hit or not even that.

> But if this AppServer is based on the ArsDigita Java
> codebase, you have other performance issues already (the Tcl codebase, OTOH,
> is very fast, partly because AOLserver is a faster appserver than most Java
> appservers).).
>

No, it is based on ObjectWeb JOnAS (Java Open Source Application
Server). The Servelet Container is Tomcat and the database is
PostgreSQL (it also works with Oracle, DB2, MySQL, etc.).

>
>>The other problem is that we have some nice graphical tools for
>>configuring logging but the /etc/syslog.conf is a very hard one to
>>automate dur to the pattern matching. We can add some lines there, like
>>one to get local0 to a specific file, but it will probably be guesswork
>>and require human inspection anyway.
>
>
> Control Center looks promising. But I much prefer having a central syslog
> server than having each server in a cluster having separate logs.
>

There are certain advantages with doing it that way and I guess some
customers will indeed do it. I believe you can very well set up logging
to a centralized syslog with Control Center (if not please open a buf
report).

>
>>It may be desirable to logrotate them at different times as well, so
>>they would have to be in different files.
>
>
> Different facilities can then go to different files. The problem, of course,
> is syslog's limited number of facilities.
>

If not used for other things, maybe 8 would be a good enough number.

>
>>>Or you'll have to include some other log rotator.
>
>
>>That is what Tom is proposing.
>
>
> I am not opposed to including a small logrotator for stderr logging. I just
> think it is redundant when a good highly configurable logging facility
> already exists. But, if Red Hat wants to pay Tom to do it... :-)

Maybe it is a question of preference or what is more convenient depends
on the specific circunstances of the installation. I would prefer to
give the option to the users, if possible.

Cheers,
Fernando