|
I can confirm that this works like a charm. I have 4 nodes, 1
fileserver, and 1 lvs machine...
The nodes are high usage, and log everything to syslog using "|
logger..." syntax in apache, and syslog forwards to @fileserver.
Fileserver uses the - option before a filename to only sync the access
log when needed to file, so that the access logs don't cause too much
filesystem access on the fileserver.
I am though concerned that I have every once in a while seen a line or
two go missing if I push too much into syslog at one time...
Can anyone confirm this?
Joe
On Fri, 2005-12-23 at 11:55 -0800, Todd Lyons wrote:
> On Thu, Dec 22, 2005 at 04:15:30PM -0800, Mark wrote:
>
> >I think what Joseph meant was whether they get mingled in a way that a line
> >(or log entry) of server A hits the log in the middle of
> >writing an entry for server B, thereby destroying both entries and causing
> >syntax errors.
> >Could that happen, or is something making sure that it will not?
>
> Oh, I see. In that case, no one hosts line will be interrupted but
> another hosts's line. The lines will be intermingled, but they will be
> complete. Here's an example:
>
> Dec 23 11:48:09 smtp2 sm-mta[7171]: jBNJm7WM007171: Milter add: header:
> X-Spam-Status: Yes, hits=30.5 required=5.0
> tests=BAYES_99,DRUGS_ERECTILE,\n\tDRUGS_MALEDYSFUNCTION,FORGED_RCVD_HELO,HTML_30_40,HTML_MESSAGE,\n\tHTML_MIME_NO_HTML_TAG,MIME_HEADER_CTYPE_ONLY,MIME_HTML_ONLY,\n\tNO_REAL_NAME,URIBL_AB_SURBL,URIBL_JP_SURBL,URIBL_OB_SURBL,URIBL_SBL,\n\tURIBL_SC_SURBL,URIBL_WS_SURBL
> autolearn=no version=3.1.0-gr0
> Dec 23 11:48:09 smtp2 sm-mta[7171]: jBNJm7WM007171: Milter: data, reject=550
> 5.7.1 Blocked by SpamAssassin
> Dec 23 11:48:09 smtp2 sm-mta[7171]: jBNJm7WM007171: to=<dianag@xxxxxxxxxx>,
> delay=00:00:01, pri=30500, stat=Blocked by SpamAssassin
> Dec 23 11:48:09 smtp1 sm-mta[10021]: jBNJm8o0010021:
> from=<qylyrxy@xxxxxxxxxxx>,size=0, class=0, nrcpts=0, proto=SMTP, daemon=MTA,
> relay=[82.131.161.22]
> Dec 23 11:48:09 smtp2 spamd[26407]: prefork: child states: IIIII
> Dec 23 11:48:09 smtp1 sm-mta[9872]: jBNJlQPs009872: <asing@xxxxxxxxxxx>...
> User unknown
> Dec 23 11:48:09 smtp1 sm-mta[10010]: jBNJm3SU010010: ruleset=check_rcpt,
> arg1=<admin@xxxxxxxxxxx>, relay=24-176-185-20.dhcp.reno.nv.charter.com
> [24.176.185.20] (may be forged), reject=550 5.7.1 <admin@xxxxxxxxxxx>...
> Relaying denied. IP name possibly forged [24.176.185.20]
>
|
