Skip to content

Tag: logging

Syslog Agents on Windows

In order to send events from a Windows device to a remote syslog server like Log Insight, you need a syslog agent. Windows does not natively support syslog. The good news is that several syslog agents for Windows exist. I would like to cover my considerations and recommendations for a syslog agent on Windows.
UPDATE: As of Log Insight 2.0, Log Insight offers a free Windows agent that supports the syslog protocol and Log Insight’s ingestion API. For more information see these┬áposts.

Syslog Agents on Linux

In order to send events from a Linux device to a remote syslog server like Log Insight, you need a syslog agent. Most Linux operating systems ship with a syslog agent and if one is not available, one can be easily installed. The two most common syslog agents used on Linux systems today are rsyslog and syslog-ng. I would like to cover how to configure these syslog agents to send events to a remote syslog server.

Logrotate Limitations Revisited

The more I use logrotate the less I like it. If you recall from my previous post on logrotate, I choose to leverage the copytruncate option. While this configuration seemed to work well when I tested it, I have now experienced some significant limitations that are not documented in the man page:

  1. After rotation, high volume logs files remained the same size and continued to grow
  2. Pre and post rotated high volume log files contained NUL characters
  3. Large sized log files lost messages during logrotate operation

So what caused the issues, what was the impact, and how can you rotate logs messages and not experience these issues?

Logrotate Limitations

I having been working on a syslog architecture and one key component to the architect was leveraging log rotate for all log files. One section of my log rotate file looked like the following:

compresscmd /bin/bzip2
compressext .bz2
/usr/sbin/invoke-rc.d syslog-ng reload >/dev/null

The problem was, I noticed that after the cron for logrotate ran the system started to become slow. Looking at top I noticed several things: the load average continued going up, the logrotate process continued to run with the process consuming around 50% of memory, and the syslog process never restarted.
What was causing the problem?