Re: Can squid log to Syslog?

George Michaelson writes:

>You *can* do this, but I think for high-traffic cachesites, this may be
>a counter-productive move.
>
>local logging is buffered (by runtime choice?) and is efficient in I/O load
>terms.
>
>syslog is UDP transactions, and thus somewhat more interrupt/atomic per
>logged event, and also (UDP) not reliable: you can get out-of-order and
>lost log events.
>
>network traffic of any kind detracts from the cache's ability to service core
>load: if its doing UDP for logs, its not processing inbound HTTP or the
>bi-directional ICP load.
>
>Would I be overstating things to say that syslog was a major weakness of
>the cisco cache engine at one stage?
>
>I'm not saying it can't or shouldn't be done, but I am saying its a function
>of your loading and local site issues. One to think about?

I should have mentioned that Squid only logs 'level 0' debugging to
syslog. This is basically only startup messages and serious
errors/warnings. It should be a really low volume.

Also, I was always under the impression that Squid wrote to the
local syslogd, and *that* process was responsible for forwarding
(via UDP) the messages over the network to other syslogs. Its just
an assumption I made, so I could be wrong?

Duane W.
Received on Tue Jun 09 1998 - 17:27:09 MDT