[logs] naming multiple output files with syslog-ng

[Marcus J. Ranum]

Jan Monsch wrote:
>MRJ raised the question when Apache logging happens. Does anybody on the
>list know more about this?

I cheated and hid the answer in my question!!! Since the web server
software is going to log whether the page request was successful or
not, it has to do it after the request has completed. That means that
the impact of logging will be completely invisible to the requestor since
they've already gotten their data and gone elsewhere.

Here's another funny part. In order to make the logging more flexible
apache does an interpretive substitution pass on every message before
it's written out. "I know! I know! let's make logging so convenient and
inefficient that everyone turns it off!"

I am emphatically not going to take the time to read this gobstopper
wad of code - simply out of primal fear of what I might find. Nor am I
going to waste the time to profile it, for the same reason. It has all
the hallmarks (beside being substantially larger than the original UNIX
kernel) of bloatware: routines that have become so fiddly overcomplex
that they had to be "optimized" by adding additional fiddly complexity.

There is no excuse - none - for logging to be so complicated that it
needs to be turned off for performance reasons. All that says is
"this is suckware" but somehow what most people hear is "logging is bad."
With the kind of performance a state of the art processor is capable
of, you've got to wonder how it's even possible to write a web server
that has performance problems. That takes real skill, I bet.

mjr.