Writing Syslog Messages to MySQL
By Rainer Gerhards2005-08-04
On Reliability...
|
|
Rsyslogd writes syslog messages directly to the database. This implies that the database must be available at the time of message arrival. If the database is offline, no space is left or something else goes wrong - rsyslogd can not write the database record. If rsyslogd is unable to store a message, it performs one retry. This is helpful if the database server was restarted. In this case, the previous connection was broken but a reconnect immediately succeeds. However, if the database is down for an extended period of time, an immediate retry does not help. While rsyslogd could retry until it finally succeeds, that would have negative impact. Syslog messages keep coming in. If rsyslogd would be busy retrying the database, it would not be able to process these messages. Ultimately, this would lead to loss of newly arrived messages.
In most cases, rsyslogd is configured not only to write to the database but to perform other actions as well. In the always-retry scenario, that would mean no other actions would be carried out. As such, the design of rsyslogd is limited to a single retry. If that does not succeed, the current message is will not be written to the database and the MySQL database writer be suspended for a short period of time. Obviously, this leads to the loss of the current message as well as all messages received during the suspension period. But they are only lost in regard to the database, all other actions are correctly carried out. While not perfect, we consider this to be a better approach then the potential loss of all messages in all actions.
In short: try to avoid database downtime if you do not want to experience message loss.
Please note that this restriction is not rsyslogd specific. All approachs to real-time database storage share this problem area.
Tutorial Pages:
» Abstract
» Background
» Overall System Setup
» Setting up the system
» On Reliability...
» Conclusion
» Feedback Requested
Copyright (c) 2005 Rainer Gerhards and Adiscon.
