[plug] server load spikes

[Craig Ringer]

On Fri, 2004-04-16 at 22:15, William Kenworthy wrote:
> Try metalog - can be set to cache the entries and seems pretty low
> overhead.

Interesting, I'll check it out.

Personally, though, if I was to replace syslogd with something else, I'd
love it to be something that'd provide information in a more pleasantly
parseable format. I /hate/ writing scripts to dig through syslog for
info; it seems such a waste of time when a more structured logging
format could save all that trouble. Even a basic key="value" convention
with reliable delimiters and quoting would be mighty handy.

I think the Event Log service under NT has some things going for it in
that regard. It didn't really take things far enough, though, in that it
doesn't provide a useful way for /apps/ to pass values to the service
except as a big binary blob + a text string.

I guess syslog needs to keep overheads low, but surely it wouldn't be
too much to do a little quoting and expect apps to pass key="value"
data. After all (as I just had rammed home) disk I/O is the big
limitation these days, not CPU time, for most jobs.

I should play with getting syslog to gzip output as it writes it, too.
It supports writing to pipes, so it might even be possible to tack it
on.

Craig Ringer