Rule of thumb for syslog size

stevewilwerding

New Member
Apr 21, 2023
20
1
3
We would ideally like to keep the syslog for 7 days to support Tracking Center, but we get a few hundred thousand emails a day, so that may be unworkable. Is there a rule of thumb for how big syslog can get before it impacts the performance of pmg-log-tracker?
 
some instances with daily logs we know have logs ~ 300 MB/day - they do get fewer mails than 100k - but the logrotation is configured weekly (so this should work as a ballpark) - performance of the Tracking Center is still quite fast (not instantaneous when looking for mails a few weeks ago though) - the logs are around 250 MB/syslog file

My guess is that with 100k-200k mails it should perform quite well (with 7days retention and daily rotation) - with a modern CPU that is (log-parsing is mostly CPU bound)

We'd appreciate feedback how it works in your environment!
 
Am I correct in saying that Tracking Center can use the syslog.2, etc., as long as they are not compressed? It doesn't all have to be in syslog?