From b04d9d6f38b849a996415e0d85add642c375181b Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Fri, 8 Aug 2008 14:34:37 +0200 Subject: added ability to specify flow control mode for imuxsock --- doc/imuxsock.html | 39 +++++++++++++++++++++++++++++---------- 1 file changed, 29 insertions(+), 10 deletions(-) (limited to 'doc/imuxsock.html') diff --git a/doc/imuxsock.html b/doc/imuxsock.html index 3beabe94..77491992 100644 --- a/doc/imuxsock.html +++ b/doc/imuxsock.html @@ -9,23 +9,41 @@

Author: Rainer Gerhards <rgerhards@adiscon.com>

Description:

-

Provides the ability to accept syslog messages via local Unix +

Provides the ability to accept syslog messages via local Unix sockets. Most importantly, this is the mechanism by which the syslog(3) -call delivers syslog messages to rsyslogd. So you need to have this +call delivers syslog messages to rsyslogd. So you need to have this module loaded to read the system log socket and be able to process log -messages from applications running on the local system.

Application-provided -timestamps are ignored by default. This is needed, as some programs -(e.g. sshd) log with inconsistent timezone information, what +messages from applications running on the local system.

+

Application-provided +timestamps are ignored by default. This is needed, as some programs +(e.g. sshd) log with inconsistent timezone information, what messes up the local logs (which by default don't even contain time zone information). This seems to be consistent with what sysklogd did for the past four years. Alternate behaviour may be desirable if gateway-like processes send messages via the local log slot - in this case, it can be enabled via the -$InputUnixListenSocketIgnoreMsgTimestamp and $SystemLogSocketIgnoreMsgTimestamp config directives

Configuration Directives:

+$InputUnixListenSocketIgnoreMsgTimestamp and $SystemLogSocketIgnoreMsgTimestamp config directives

+

Unix log sockets can be flow-controlled. That is, if processing queues fill up, +the unix socket reader is blocked for a short while. This may be useful to prevent overruning +the queues (which may cause exessive disk-io where it actually would not be needed). However, +flow-controlling a log socket (and especially the system log socket) can lead to a very +unresponsive system. As such, flow control is disabled by default. That means any log records +are places as quickly as possible into the processing queues. If you would like to have +flow control, you need to enable it via the $SystemLogSocketFlowControl and +$InputUnixListenSocketFlowControl config directives. Just make sure you thought about +the implications. Note that for many systems, turning on flow control does not hurt. +

Configuration Directives: