syslogd pipelines losing messages

[David Malone]

On Mon, Jan 24, 2005 at 10:39:23AM -0500, Felix Hernandez-Campos wrote:
> Anyway, I think I did all the homework, and I just need someone to
> suggest an elegant solution rather than my usleep (is there a
> yield-type syscall?). I'm more than willing to try out your ideas in
> our environment and prepare the patch when something good comes up.

I'd guess that the pipe is filling, as there is only so much that
you can write to a pipe before it fills. So, as you say, the usleep
is giving a chance for the reader to clear the pipe. I guess that
syslogd may be reading a big chunk of messages and writing them all
at once, without a pause.

I have a feeling that it won't help, but it would be useful if you
could install the buffer program from ports and add it to your
pipeline, something like:

local0.*        | exec buffer | grep -v DUPLEX_MISMATCH >> /usr/home2/wap_syslog_local0

to see if it helps. I suspect it won't and it might be necessary
to either yeild or to use aio or something. You could try using
sched_yield() to give the other process a chance.

	David.