[logs] naming multiple output files with syslog-ng

[Marcus J. Ranum]

Jan Monsch wrote:
>I personally do not like the solution, because the
>logger gets invoked by the Apache process and this most likely produces
>overhead in the Apache process.

#ifdef  LONG_FORM

The first law of performance tuning is "first you measure, then you
speculate."

It's quite possible (and if you wanted to lay a bet...) that Apache
spends an infinitesimal amount of time and resources doing its
logging. It's also quite possible (consider the sequence of events!)
that Apache doesn't issue the log message until after the transaction
with the user is completed, in which case the impact on the user
is nonexistent. But the point is that nobody knows until somebody
measures.

Administrators consistently blow logging off because "it'll slow things
down." To which the correct response is always, "Really? When you
measured it, how significant was the impact?"

Back when I was programming full time, I used to regularly pick up free
lunches by betting people their guesses about performance bottlenecks
were wrong. :)  I was a decent programmer, once, and pretty much
every time _I_ tried to guess about the bottlenecks in my own code,
I was wrong.

#endif

#ifdef  WISEASS_FORM

WTF is someone doing even TALKING about performance if they
are running Apache?

That's like asking "is this stuff fattening?" around a mouthful of
pulled pork, Ben&Jerry's, and butter.

#endif


mjr.