From owner-freebsd-questions Tue May 16 1:15: 6 2000 Delivered-To: freebsd-questions@freebsd.org Received: from theo.namodn.com (anyhosting.com [209.0.100.50]) by hub.freebsd.org (Postfix) with ESMTP id A10EB37B7A9 for ; Tue, 16 May 2000 01:15:02 -0700 (PDT) (envelope-from robert@theo.namodn.com) Received: (from robert@localhost) by theo.namodn.com (8.9.3/8.9.3) id AAA09104; Tue, 16 May 2000 00:43:59 -0700 Date: Tue, 16 May 2000 00:43:59 -0700 From: Rob To: cjclark@home.com Cc: freebsd-questions@freebsd.org Subject: Re: access logging via syslog ( apache ) Message-ID: <20000516004359.C8939@theo.namodn.com> References: <20000515181006.B7545@theo.namodn.com> <20000515230138.H55458@cc942873-a.ewndsr1.nj.home.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii User-Agent: Mutt/1.0.1i In-Reply-To: <20000515230138.H55458@cc942873-a.ewndsr1.nj.home.com>; from cjc@cc942873-a.ewndsr1.nj.home.com on Mon, May 15, 2000 at 11:01:39PM -0400 Organization: Namodn Artists - http://www.namodn.com X-OS-Type: Debian GNU/Linux 2.2 Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG [snip] > > > However, syslogd will substitute "last message > > repeated XX times" if the occurences happen > > more than a couple times a second. > > > > Is there any way to turn this off? > > Looking at the source code, it seems that there is no way. It might be > worth a compile time #define if not a runtime flag. [snip] Thanks for your reply! I considered hacking the source ( it's alot smaller than I expected for some reason ), but altering the CustomLog directive to provide a unique identifier ( perhaps show a more accurate timestamp? ) in the httpd.conf of Apache would be a cleaner ( to my mind ) approach than having a modified binary on the filesystem. Although in real life the chance of the same IP hitting the same URL more than once a second is very low, I am paranoid :) Rsync and NFS have their own disadvantages, like the possibility of rsync copying a 0 byte file over the originial ( although I suppose it could be copied then concatenated, but it is still batch and not real time ) and NFS would cause strange behavior on the clients ( read: webservers ) if the NFS server were to go down. We hashed this one at for a while at work :) Just thought I'd share a few ups/downs we came up with. Our estimates don't show the kind of traffic that would cause the fact that syslog uses UDP to become a problem due to too much traffic on the wire. On the other hand, is there any userland way to force a daemon to use TCP rather than UDP? Is there something essential about UDP that syslog cannot do without? Rob Namodn To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message