Search code examples
cachingloggingsysloginotify

How to effectively use iNotify with rSyslog caching?

By default, rsyslog doesn't sync data to log file immediately for performance reasons. Ref to section Output File Syncing

Does that mean that there could be a scenario where if I am using iNotify on syslog files, I may miss an event?

So far, I am monitoring files using tail -f and it seems to be catching all the events. But I am paranoid that syslog caching may lead to inotify events being missed.

Solution

  • I went ahead and created this- http://code.google.com/p/logmon/ as per @cpugeniusmv suggestion