Messages in this thread | | | Date | Sat, 13 Feb 1999 00:06:42 -0600 (CST) | From | Oliver Xymoron <> | Subject | Re: fsync on large files |
| |
On Sat, 13 Feb 1999, Alan Curry wrote:
> Simon Kirby writes the following: > > > >There's no way in hell I'd run syslogd with fsync() enabled on a machine > >that longs anything more than 1 line per minute. Disable fsync()ing in > >syslogd by prepending "-" to each log file you want to turn it off for. > > I know that, and I've already done that as a temporary solution. But syslogd > syncs every line written for a good reason, namely that if the machine > crashes you don't want to lose the last few lines that were logged. They are > the most likely place to look for suspicious happenings. So I want a proper > fix, not a "disable the safety feature" kludge.
There's a fair chance you'll lose the lines you're really interested in if you crash anyway - as you've noticed, syncing is a sometimes an intensive operation. A _real_ fix, which also deals with log security issues nicely, is to log across a serial port to a secure (possibly non-networked) host.
-- "Love the dolphins," she advised him. "Write by W.A.S.T.E.."
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |