Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want every server to send logs to /var/log and and copy to a remote syslog-ng server. I've heard anecdotes how logging remotely can hang your application if the network has problems. Should I be concerned about my app hanging when logging remotely, and how would I fix/work-around it?

share|improve this question

No. For one, the handoff is asynchronous within the local operating system. syslog libraries and the local syslog daemon will either accept the message and fail to deliver it or fail-fast, but either way your app won't hang. Secondly the network protocol is (by default) udp so even if your application blocked until the packet got sent out, it would go out instantly and return control to your app regardless of if it actually makes it to the collecting host.

When people think of remote logging hanging things in *nix land its usually because they were logging to an nfs mount, which most certainly can cause hangs. Syslog, you're good.

share|improve this answer

I know it's an old message, but I'll answer if other people hit this page.

We've seen a case where remote logging make a server hang. Syslog-ng, when losing network access to his loghost, start to buffer. And when the buffer get full, it stop reading from the /dev/log file, that get "full", making our auditing fail, trying to write to /dev/log.

share|improve this answer
    
Do you have a solution to this? I'm having an issue very similar to this situation and it even makes services that want to log to rsyslog hang (like my mail server) I have not found a solution, only the workaround of restarting the log host. – gparent Oct 27 '15 at 18:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.