> Simon Kirby writes the following:
> >
> >There's no way in hell I'd run syslogd with fsync() enabled on a machine
> >that longs anything more than 1 line per minute. Disable fsync()ing in
> >syslogd by prepending "-" to each log file you want to turn it off for.
>
> I know that, and I've already done that as a temporary solution. But syslogd
> syncs every line written for a good reason, namely that if the machine
> crashes you don't want to lose the last few lines that were logged. They are
> the most likely place to look for suspicious happenings. So I want a proper
> fix, not a "disable the safety feature" kludge.
There's a fair chance you'll lose the lines you're really interested in if
you crash anyway - as you've noticed, syncing is a sometimes an intensive
operation. A _real_ fix, which also deals with log security issues nicely,
is to log across a serial port to a secure (possibly non-networked) host.
-- "Love the dolphins," she advised him. "Write by W.A.S.T.E.."
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/