Re: Can squid log to Syslog?

  "Robert Adams" writes:
  
>Hello everyone,
>
> Is is possible to get squid to log to a remote syslogd?
  
  yep. You have to configure syslogd.conf on your machine
  where Squid runs. Squid uses LOG_ERR and LOG_LOCAL4, so
  probably something like
  
          local4.err @some.other.host
  
  Duane W.

You *can* do this, but I think for high-traffic cachesites, this may be
a counter-productive move.

local logging is buffered (by runtime choice?) and is efficient in I/O load
terms.

syslog is UDP transactions, and thus somewhat more interrupt/atomic per
logged event, and also (UDP) not reliable: you can get out-of-order and
lost log events.

network traffic of any kind detracts from the cache's ability to service core
load: if its doing UDP for logs, its not processing inbound HTTP or the
bi-directional ICP load.

Would I be overstating things to say that syslog was a major weakness of
the cisco cache engine at one stage?

I'm not saying it can't or shouldn't be done, but I am saying its a function
of your loading and local site issues. One to think about?

-George

--
George Michaelson         |  DSTC Pty Ltd
Email: ggm@dstc.edu.au    |  University of Qld 4072
Phone: +61 7 3365 4310    |  Australia
  Fax: +61 7 3365 4311    |  http://www.dstc.edu.au