LogAnalysis
[logs] naming multiple output files with syslog-ng Dec 17 2007 02:20PM
Christian Folini (christian folini post ch) (2 replies)
RE: [logs] naming multiple output files with syslog-ng Dec 20 2007 03:55PM
Jan Monsch (jan monsch csnc ch) (1 replies)
RE: [logs] naming multiple output files with syslog-ng Dec 20 2007 04:25PM
Marcus J. Ranum (mjr ranum com) (3 replies)
Re: [logs] naming multiple output files with syslog-ng Dec 27 2007 01:14AM
Mordechai T. Abzug (morty frakir org) (1 replies)
Re: [logs] naming multiple output files with syslog-ng Jan 01 2008 01:05PM
Chris Brenton (cbrenton chrisbrenton org)
RE: [logs] naming multiple output files with syslog-ng Dec 20 2007 06:22PM
Paul Melson (pmelson gmail com) (1 replies)
Re: [logs] naming multiple output files with syslog-ng Dec 21 2007 06:55AM
Christian Folini (christian folini post ch) (2 replies)
Re: [logs] naming multiple output files with syslog-ng Dec 21 2007 04:16PM
Chris Wee (chris wee loglogic com) (1 replies)
Re: [logs] naming multiple output files with syslog-ng Dec 24 2007 10:49AM
Christian Folini (christian folini post ch)
RE: [logs] naming multiple output files with syslog-ng Dec 21 2007 10:19AM
Jan Monsch (jan monsch csnc ch) (1 replies)
RE: [logs] naming multiple output files with syslog-ng Dec 23 2007 08:06PM
Marcus J. Ranum (mjr ranum com)
Jan Monsch wrote:
>MRJ raised the question when Apache logging happens. Does anybody on the
>list know more about this?

I cheated and hid the answer in my question!!! Since the web server
software is going to log whether the page request was successful or
not, it has to do it after the request has completed. That means that
the impact of logging will be completely invisible to the requestor since
they've already gotten their data and gone elsewhere.

Here's another funny part. In order to make the logging more flexible
apache does an interpretive substitution pass on every message before
it's written out. "I know! I know! let's make logging so convenient and
inefficient that everyone turns it off!"

I am emphatically not going to take the time to read this gobstopper
wad of code - simply out of primal fear of what I might find. Nor am I
going to waste the time to profile it, for the same reason. It has all
the hallmarks (beside being substantially larger than the original UNIX
kernel) of bloatware: routines that have become so fiddly overcomplex
that they had to be "optimized" by adding additional fiddly complexity.

There is no excuse - none - for logging to be so complicated that it
needs to be turned off for performance reasons. All that says is
"this is suckware" but somehow what most people hear is "logging is bad."
With the kind of performance a state of the art processor is capable
of, you've got to wonder how it's even possible to write a web server
that has performance problems. That takes real skill, I bet.

mjr.
_______________________________________________
LogAnalysis mailing list
LogAnalysis (at) loganalysis (dot) org [email concealed]
http://www.loganalysis.org/mailman/listinfo/loganalysis

[ reply ]
Re: [logs] naming multiple output files with syslog-ng Dec 20 2007 05:23PM
Bill Burge (bill burge com)
Re: [logs] naming multiple output files with syslog-ng Dec 18 2007 06:22AM
Tom Le (dottom gmail com)


 

Privacy Statement
Copyright 2010, SecurityFocus