[systemd-devel] [PACKAGERS] rsyslog and systemd

[Lennart Poettering]

On Fri, 11.03.11 09:39, Andrey Borzenkov (arvidjaar at mail.ru) wrote:

> > Both seem to equally work for me,
> 
> Well ... without systemd-kmsg-syslogd, you rely on kernel to buffer
> all data until rsyslogd is started;all datagrams beyond backlog size
> (default 128) are lost.

backlog is not the right term, as that is appropriate for SOCK_STREAM
sockets only where you call listen(). The /dev/log socket we use is
SOCK_DGRAM however. How much data we can queue in that is controlled via
SO_RCVBUF and is quite large by default, but can easily be exhausted if
you get a lot of selinux AVCs for example...

Lennart

-- 
Lennart Poettering - Red Hat, Inc.