[rsyslog] Feedback request: in-memory buffering messages

[RB]

> I actually (really ;)) do not know syslog-ng and keep myself somewhat
> away from it to prevent accidental steal of "whatever" from there. But
> now that you raise the point: could you quickly describe how it works.
> From your mail, it sounds like what I am thinking about...

I 100% agree with and applaud that separation.  As you've stated
before, they make a good product and don't warrant any interference.

Not touching the docs myself (since I know too much of it by heart
anyway), flush_lines allows the admin to configure a particular number
of log entries to buffer before forcing a flush to disk, whereas
flush_timeout configures the maximum interval between disk flushes.
Unlike ramlog, it seems to do this with internal allocations and
doesn't rely on a ramdisk.  I usually set it rather conservatively (20
and 600 respectively), but I can definitely see being more aggressive
on a dedicated log collector with critical power or a laptop in
ultra-low power mode.

This has been a feature of the public version of syslog-ng for as long
as I can remember (or four years, whichever is sooner ;).  Combined
with disk queues I can see a very nice tiered approach to handling
extremely high volumes of log data in a rather reliable manner.