[bashtoni]

Nice work!

We write the logs to disk and then use rsyslogs imfile feature to read from there. Your approach has the advantage of not requiring disk writes.

BTW, we're not in Toronto, but we're hiring and happy to accept remote workers from that timezone :)

http://www.bashton.com/jobs/

[blibble]

put your logs in /dev/shm

oh and don't remember to rotate them!

[otterley]

If you need guaranteed log delivery, I wouldn't do that. Unread logs won't survive a power failure or system crash.

[res0nat0r]

Aren't you also not ensuring delivery when using remote syslogging in default mode? I believe this is all logged via UDP, so if the network or syslog host is overloaded your syslog messages will be silently dropped.

[otterley]

In default mode, sure. But modern syslog daemons also support TCP transports. And both rsyslog and syslog-ng have commercial versions that buffer logs to disk (though double-buffering isn't necessary here where the source is a log file already on disk).

[bashtoni]

That's correct. rsyslog also supports TCP though.

[teraflop]

Writing to /var/log doesn't get you guaranteed delivery either, unless you're calling fsync() after every write.