On Wed, 8 Jul 1998, Dom Mitchell wrote:
> There is the additional problem, that for a busy machine, syslog is
> known to be an unreliable protocol and does drop some messages when it
the version of syslog with solaris allows you to have multiple entries
in syslog.conf for the same type (facility etc) of log message, which means
you can log the same thing to remote host(s) and to a file.
if Exim used different types of syslog message, the sys admin can set up
syslog to funnel messages to one place or not.
> Actually, we would need to keep the existing logging format anyway to
> make some sense of spool/msglog. You can't do that with plain syslog.
agreed, especially rejectlog, which is invaluable for detecting spam attacks.
I would definitely use syslog to log paniclog entries to a central log server,
but I'd also log to a local disk to ensure the total record was kept; I'd
probably not remotely log mainlog nor rejectlog, they're way too "noisy"...
Log files sizes for yesterday, on a machine delivering 40000 messages per day:
-rw-r----- 1 root other 14728525 Jul 9 00:07 mainlog.1
-rw-r----- 1 root other 628715 Jul 9 00:07 rejectlog.1
The paniclog doesn't get rotated... its quite short (except when when something
goes wrong!):
-rw-r--r-- 1 root other 8419 Jul 8 07:19 paniclog
Paul
----
P Mansfield, Senior SysAdmin PSINet, +44-1223-577577x2611/577611 fax:577600
Life begins at 70....mph : www.mansfield.co.uk/paulm/mcycle
--
*** Exim information can be found at
http://www.exim.org/ ***
