collectd() destination options
This section describes the options of the collectd() destination in syslog-ng OSE.
The collectd() destination has the following options. The plugin() and type() options are required options. You can also set other options of the underlying unix-stream() driver (for example, socket buffer size).
disk-buffer()
Description: This option enables putting outgoing messages into the disk buffer of the destination to avoid message loss in case of a system failure on the destination side. It has the following suboptions:
capacity-bytes()
| Type: | number (bytes) |
| Default: | 1 MiB |
Description: This is a required option. The maximum size of the disk-buffer in bytes. The minimum value is 1048576 bytes. If you set a smaller value, the minimum value will be used automatically. It replaces the old log-disk-fifo-size() option.
In syslog-ng OSE version 4.2 and earlier, this option was called disk-buf-size().
compaction()
| Type: | yes/no |
| Default: | no |
Description: If set to yes, syslog-ng OSE prunes the unused space in the LogMessage representation, making the disk queue size smaller at the cost of some CPU time. Setting the compaction() argument to yes is recommended when numerous name-value pairs are unset during processing, or when the same names are set multiple times.
NOTE: Simply unsetting these name-value pairs by using the unset() rewrite operation is not enough, as due to performance reasons that help when syslog-ng OSE is CPU bound, the internal representation of a LogMessage will not release the memory associated with these name-value pairs. In some cases, however, the size of this overhead becomes significant (the raw message size can grow up to four times its original size), which unnecessarily increases the disk queue file size. For these cases, the compaction will drop unset values, making the LogMessage representation smaller at the cost of some CPU time required to perform compaction.
dir()
| Type: | string |
| Default: | N/A |
Description: Defines the folder where the disk-buffer files are stored.
CAUTION: When creating a new dir() option for a disk buffer, or modifying an existing one, make sure you delete the persist file.
syslog-ng OSE creates disk-buffer files based on the path recorded in the persist file. Therefore, if the persist file is not deleted after modifying the dir() option, then following a restart, syslog-ng OSE will look for or create disk-buffer files in their old location. To ensure that syslog-ng OSE uses the new dir() setting, the persist file must not contain any information about the destinations which the disk-buffer file in question belongs to.
flow-control-window-bytes()
| Type: | number (bytes) |
| Default: | 163840000 |
Description: Use this option if the option reliable() is set to yes. This option contains the size of the messages in bytes that is used in the memory part of the disk buffer. It replaces the old log-fifo-size() option. It does not inherit the value of the global log-fifo-size() option, even if it is provided. Note that this option will be ignored if the option reliable() is set to no.
In syslog-ng OSE version 4.2 and earlier, this option was called mem-buf-size().
flow-control-window-size()
| Type: | number(messages) |
| Default: | 10000 |
Description: Use this option if the option reliable() is set to no. This option contains the number of messages stored in overflow queue. It replaces the old log-fifo-size() option. It inherits the value of the global log-fifo-size() option if provided. If it is not provided, the default value is 10000 messages. Note that this option will be ignored if the option reliable() is set to yes.
In syslog-ng OSE version 4.2 and earlier, this option was called mem-buf-length().
front-cache-size()
| Type: | number(messages) |
| Default: | 1000 |
Description: The number of messages stored in the output buffer of the destination. Note that if you change the value of this option and the disk-buffer already exists, the change will take effect when the disk-buffer becomes empty.
Options reliable() and capacity-bytes() are required options.
In syslog-ng OSE version 4.2 and earlier, this option was called qout-size().
prealloc()
| Type: | yes/no |
| Default: | no |
Description: By default, syslog-ng OSE doesn’t reserve the disk space for the disk-buffer file, since in a properly configured and sized environment the disk-buffer is practically empty, so a large preallocated disk-buffer file is just a waste of disk space. But a preallocated buffer can prevent other data from using the intended buffer space (and elicit a warning from the OS if disk space is low), preventing message loss if the buffer is actually needed. To avoid this problem, when using syslog-ng OSE 4.0 or later, you can preallocate the space for your disk-buffer files by setting prealloc(yes).
In addition to making sure that the required disk space is available when needed, preallocated disk-buffer files provide radically better (3-4x) performance as well: in case of an outage the amount of messages stored in the disk-buffer is continuously growing, and using large continuous files is faster, than constantly waiting on a file to change its size.
If you are running syslog-ng OSE on a dedicated host (always recommended for any high-volume settings), use prealloc(yes).
Available in syslog-ng OSE 4.0 and later.
reliable()
| Type: | yes/no |
| Default: | no |
Description: If set to yes, syslog-ng OSE cannot lose logs in case of reload/restart, unreachable destination or syslog-ng OSE crash. This solution provides a slower, but reliable disk-buffer option. It is created and initialized at startup and gradually grows as new messages arrive. If set to no, the normal disk-buffer will be used. This provides a faster, but less reliable disk-buffer option.
CAUTION: Hazard of data loss! If you change the value of reliable() option when there are messages in the disk-buffer, the messages stored in the disk-buffer will be lost.
truncate-size-ratio()
| Type: | number((between 0 and 1)) |
| Default: | 1 (do not truncate) |
Description: Limits the truncation of the disk-buffer file. Truncating the disk-buffer file can slow down the disk IO operations, but it saves disk space. By default, syslog-ng OSE version 4.0 and later doesn’t truncate disk-buffer files by default (truncate-size-ratio(1)). Earlier versions freed the disk-space when at least 10% of the disk-buffer file could be freed (truncate-size-ratio(0.1)).
syslog-ng OSE only truncates the file if the possible disk gain is more than truncate-size-ratio() times capacity-bytes().
- Smaller values free disk space quicker.
- Larger ratios result in better performance.
If you want to avoid performance fluctuations:
- use truncate-size-ratio(1) (never truncate), or
- use prealloc(yes) to reserve the entire size of the disk-buffer on disk.
CAUTION: It is not recommended to change truncate-size-ratio(). Only change its value if you understand the performance implications of doing so.
Example: Examples for using disk-buffer()
In the following case reliable disk-buffer() is used.
destination d_demo {
network(
"127.0.0.1"
port(3333)
disk-buffer(
flow-control-window-bytes(10000)
capacity-bytes(2000000)
reliable(yes)
dir("/tmp/disk-buffer")
)
);
};
In the following case normal disk-buffer() is used.
destination d_demo {
network(
"127.0.0.1"
port(3333)
disk-buffer(
flow-control-window-size(10000)
capacity-bytes(2000000)
reliable(no)
dir("/tmp/disk-buffer")
)
);
};
flush-lines()
| Type: | number |
| Default: | Use global setting (exception: for http() destination, the default is 1). |
Description: Specifies how many lines are flushed to a destination at a time. The syslog-ng OSE application waits for this number of lines to accumulate and sends them off in a single batch. Increasing this number increases throughput as more messages are sent in a single batch, but also increases message latency.
The syslog-ng OSE application flushes the messages if it has sent flush-lines() number of messages, or the queue became empty. If you stop or reload syslog-ng OSE or in case of network sources, the connection with the client is closed, syslog-ng OSE automatically sends the unsent messages to the destination.
For optimal performance when sending messages to an syslog-ng OSE server, make sure that the value of flush-lines() is smaller than the window size set in the log-iw-size() option in the source of your server.
frac-digits()
| Type: | number |
| Default: | 0 |
Description: The syslog-ng OSE application can store fractions of a second in the timestamps according to the ISO8601 format. The frac-digits() parameter specifies the number of digits stored. The digits storing the fractions are padded by zeros if the original timestamp of the message specifies only seconds. Fractions can always be stored for the time the message was received.
NOTE: The syslog-ng OSE application can add the fractions to non-ISO8601 timestamps as well.
NOTE: As syslog-ng OSE is precise up to the microsecond, when the frac-digits() option is set to a value higher than 6, syslog-ng OSE will truncate the fraction seconds in the timestamps after 6 digits.
hook-commands()
Description: This option makes it possible to execute external programs when the relevant driver is initialized or torn down. The hook-commands() can be used with all source and destination drivers with the exception of the usertty() and internal() drivers.
NOTE: The syslog-ng OSE application must be able to start and restart the external program, and have the necessary permissions to do so. For example, if your host is running AppArmor or SELinux, you might have to modify your AppArmor or SELinux configuration to enable syslog-ng OSE to execute external applications.
Using the hook-commands() when syslog-ng OSE starts or stops
To execute an external program when syslog-ng OSE starts or stops, use the following options:
startup()
| Type: | string |
| Default: | N/A |
Description: Defines the external program that is executed as syslog-ng OSE starts.
shutdown()
| Type: | string |
| Default: | N/A |
Description: Defines the external program that is executed as syslog-ng OSE stops.
Using the hook-commands() when syslog-ng OSE reloads
To execute an external program when the syslog-ng OSE configuration is initiated or torn down, for example, on startup/shutdown or during a syslog-ng OSE reload, use the following options:
setup()
| Type: | string |
| Default: | N/A |
Description: Defines an external program that is executed when the syslog-ng OSE configuration is initiated, for example, on startup or during a syslog-ng OSE reload.
teardown()
| Type: | string |
| Default: | N/A |
Description: Defines an external program that is executed when the syslog-ng OSE configuration is stopped or torn down, for example, on shutdown or during a syslog-ng OSE reload.
Example: Using the hook-commands() with a network source
In the following example, the hook-commands() is used with the network() driver and it opens an iptables port automatically as syslog-ng OSE is started/stopped.
The assumption in this example is that the LOGCHAIN chain is part of a larger ruleset that routes traffic to it. Whenever the syslog-ng OSE created rule is there, packets can flow, otherwise the port is closed.
source {
network(transport(udp)
hook-commands(
startup("iptables -I LOGCHAIN 1 -p udp --dport 514 -j ACCEPT")
shutdown("iptables -D LOGCHAIN 1")
)
);
};
host()
| Type: | string, macro, or template |
| Default: | ${HOST} |
Description: The hostname that is passed to collectd. By default, syslog-ng OSE uses the host from the log message as the hostname.
interval()
| Type: | integer |
| Default: | 60 |
Description: The interval in which the data is collected.
log-fifo-size()
| Type: | number |
| Default: | Use global setting. |
Description: The number of messages that the output queue can store.
keep-alive()
| Type: | yes or no |
| Default: | yes |
Description: Specifies whether connections to sources should be closed when syslog-ng OSE is forced to reload its configuration (upon the receipt of a SIGHUP signal). Note that this applies to the server (source) side of the syslog-ng OSE connections, client-side (destination) connections are always reopened after receiving a HUP signal unless the keep-alive option is enabled for the destination.
plugin()
| Type: | string |
| Default: |
Description: The name of the plugin that submits the data to collectd.
For example:
plugin("${PROGRAM}"),
plugin-instance()
| Type: | string |
| Default: |
Description: The name of the plugin-instance that submits the data to collectd.
socket()
| Type: | path |
| Default: | /var/run/collectd-unixsock |
Description: The path to the socket of collectd. For details, see the collectd-unixsock(5) manual page.
so-broadcast()
| Type: | yes or no |
| Default: | no |
Description: This option controls the SO_BROADCAST socket option required to make syslog-ng OSE send messages to a broadcast address. For details, see the socket(7) manual page.
so-keepalive()
| Type: | yes or no |
| Default: | no |
Description: Enables keep-alive messages, keeping the socket open. This only effects TCP and UNIX-stream sockets. For details, see the socket(7) manual page.
so-rcvbuf()
| Type: | number |
| Default: | 0 |
Description: Specifies the size of the socket receive buffer in bytes. For details, see the socket(7) manual page.
(that is, the syslog-ng OSE server or relay receiving the messages).Note that on certain platforms, for example, on Red Hat Enterprise Linux 5, even low message load (~200 messages per second) can result in message loss, unless the so-rcvbuf() option of the source is increased. In this cases, you will need to increase the net.core.rmem_max parameter of the host (for example, to 1024000), but do not modify net.core.rmem_default parameter.
As a general rule, increase the so-rcvbuf() so that the buffer size in kilobytes is higher than the rate of incoming messages per second.
For example, to receive 2000 messages per second, set the so-rcvbuf() at least to 2 097 152 bytes.
so-sndbuf()
| Type: | number |
| Default: | 0 |
Description: Specifies the size of the socket send buffer in bytes. For details, see the socket(7) manual page.
suppress()
| Type: | seconds |
| Default: | 0 (disabled) |
Description: If several identical log messages would be sent to the destination without any other messages between the identical messages (for example, an application repeated an error message ten times), syslog-ng OSE can suppress the repeated messages and send the message only once, followed by the Last message repeated n times. message. The parameter of this option specifies the number of seconds syslog-ng OSE waits for identical messages.
throttle()
| Type: | number |
| Default: | 0 |
Description: Sets the maximum number of messages sent to the destination per second. Use this output-rate-limiting functionality only when using disk-buffer as well to avoid the risk of losing messages. Specifying 0 or a lower value sets the output limit to unlimited.
type()
| Type: | string or template |
| Default: |
Description: Identifies the type and number of values passed to collectd. For details, see the [types.db manual page] (https://collectd.org/documentation/manpages/types.db.5.shtml).
For example:
type("gauge"),
type-instance()
| Type: | string |
| Default: |
Description: For example:
type-instance("seqnum"),
values()
| Type: | string, macro, or template |
| Default: | U |
Description: Colon-separated list of the values to send to collectd. For example:
values("${SEQNUM}"),