Use Logstash it's 10 times better than 'quick' hack for those problems.
How are you using Logstash? I have NGINX write the log, then the log-shipper suck that log file up. If you have a better work flow, please share. :)
NGINX syslog-ing without breaking the bank or patching the code
41–47 of 47 posts
Re: NGINX syslog-ing without breaking the bank or patching the code
#42Earlier quoted context omitted.
put your logs in /dev/shm oh and don't remember to rotate them!
If you need guaranteed log delivery, I wouldn't do that. Unread logs won't survive a power failure or system crash.
Writing to /var/log doesn't get you guaranteed delivery either, unless you're calling fsync() after every write.
Re: NGINX syslog-ing without breaking the bank or patching the code
#43"Devops" can be considered a philosophy, a methodology, or a movement. It doesn't mean "ops monkey smart enough to code." Referring to a human as a "devop" is equivalent to calling someone an "agile".
"Devops" can also be considered a buzzword, misused so frequently by marketers and executives, that it has become a useless term for anything besides techobabble.
P.S. who the hell refers to someone as "a human"?
Re: NGINX syslog-ing without breaking the bank or patching the code
#44Earlier quoted context omitted.
If you were using systemd, I'd imagine you'd tell it to restart your syslogger automagically, and use ExecStartPost or ExecReload to tickle nginx.
I'm a little concerned that these days to go-to answer for a crashing daemon is to have another daemon that watches it and restarts it. Who watches the watchers? What happened to writing things that don't break?
Re: NGINX syslog-ing without breaking the bank or patching the code
#45"Devops" can be considered a philosophy, a methodology, or a movement. It doesn't mean "ops monkey smart enough to code." Referring to a human as a "devop" is equivalent to calling someone an "agile".
Actually it usually means a dev who knows ops stuff as well.
Realistically its just a job title that means paying technical architects less money...
Re: NGINX syslog-ing without breaking the bank or patching the code
#46What about this one https://github.com/yaoweibin/nginx_syslog_patch ?
Re: NGINX syslog-ing without breaking the bank or patching the code
#47Earlier quoted context omitted.
>If the pipe consumer (i.e. your syslog server) stalls, then it will be much worse than writing to a local file, as it could cause a denial of service. But how likely is that to happen in any circumstance that doesn't also bring down nginx anyways? Obviously in the case of a large setup like that they don't care, it just gets removed from the pool regardless of why it is failing.
Extremely likely. I've seen the rsyslog daemon die randomly many times, for example. Whereas in 6+ years of using Nginx I've never seen it fall over a single time. Web serving is usually a primary purpose for a server. You do not want your web site to be down just because the machine's syslog daemon died.
Our notions of "extremely likely" differ then. I have never had syslogd crash. If you have, you should be switching to a different syslogd.