We would ideally like to keep the syslog for 7 days to support Tracking Center, but we get a few hundred thousand emails a day, so that may be unworkable. Is there a rule of thumb for how big syslog can get before it impacts the performance of pmg-log-tracker?
Rule of thumb for syslog size
- Thread starter stevewilwerding
- Start date
some instances with daily logs we know have logs ~ 300 MB/day - they do get fewer mails than 100k - but the logrotation is configured weekly (so this should work as a ballpark) - performance of the Tracking Center is still quite fast (not instantaneous when looking for mails a few weeks ago though) - the logs are around 250 MB/syslog file
My guess is that with 100k-200k mails it should perform quite well (with 7days retention and daily rotation) - with a modern CPU that is (log-parsing is mostly CPU bound)
We'd appreciate feedback how it works in your environment!
My guess is that with 100k-200k mails it should perform quite well (with 7days retention and daily rotation) - with a modern CPU that is (log-parsing is mostly CPU bound)
We'd appreciate feedback how it works in your environment!
Am I correct in saying that Tracking Center can use the syslog.2, etc., as long as they are not compressed? It doesn't all have to be in syslog?
Currently the filenames that are checked are hardcoded in the source (we're planning on making this a bit more comfortably configurable) - here:
https://git.proxmox.com/?p=pmg-log-...62995ed065b49d5039379bc485405aa;hb=HEAD#l2157
so as long as you use regular logrotation with the delaycompress option for syslog you should be fine
https://git.proxmox.com/?p=pmg-log-...62995ed065b49d5039379bc485405aa;hb=HEAD#l2157
so as long as you use regular logrotation with the delaycompress option for syslog you should be fine