Re: Syslog facility

[Chip Seraphine]

John Sechrest wrote:
> As you are doing specific debugging, I think it would be 
> valuable to be able to turn on and off different levels of 
> logging at different spots.

I'd think that might be overkill.  If you can control the facility, your 
syslog.conf can control the effective verbosity simply by telling that 
facility to drop everything below .info or whatever.

Besides, for serious debugging you are going to use the debug and 
verbose flags, not watch syslog.  The logging should be aimed primarily 
at notifying the maintainer of events worthy of notice, with enough 
"other" stuff to help him/her reconstruct events.  IMHO, anyway.


> Certainly choosing where to syslog to is a good thing. 
> But this should be adjustable at different points.

I agree.  It would be useful to be able to redefine it at different 
points....  perhaps have an include log to a different facility.

> As we deploy our web cluster, we are finding that syslog is 
> a key bottleneck in system performance. 
>
> It may be worth looking at how syslog effects performance.

I'd venture to say that the performance of various syslogd 
implementations is entirely outside of the scope of the cfengine 
project.  If your syslog daemon is too slow, either use another one or 
rethink your implementation or don't use syslog.

> If you have 5000 machines all running cfengine, all 
> syslogging to the same server at the same time,
> I bet things get slow

Again, outside of cfengine's scope.  Syslogd lets you direct your 
sysloggery to whatever you want.  If you have 5000 systems blasting UDP 
at one box, well, you will probably get what you deserve :-)