Are the ring buffer, the queue of messages, and the write buffer the same? If not, how do ring buffer, queue and write buffer work together in syslogd or rsyslogd?
Most implementations of syslogd queue messages for a short time, and handle duplicate messages which arrive at the queue during this period.
A sync to the disk on each write to the file can be delayed for faster writes, by
-preceding the filename in
/etc/syslog.conf, for example
When syslogd or rsyslogd writes new logs into the ring buffer, does it also write the same new logs to file
At any time, is the content of the ring buffer always part of the content of file
/var/log/syslog, or can it be ahead of the file and make the content of the file outdated?