1

Some syslog implementations on linux (sysklogd, rsyslog) include the following line in their default configuration:

mail.*    -/var/log/maillog

As far as I know the dash sign means that it is not required to do sync() after a log message is written to this logfile.

Why is that and why should we handle maillog differently?

quanta
  • 51,798
Zizzencs
  • 947
  • 1
  • 10
  • 22

1 Answers1

0

One possible reason: /var/log/maillog is usually so huge. Put a minus sign before this entry to avoid slow down the system (when syncing the file after every logging).

quanta
  • 51,798
  • Well, probably, but I have log files that are way larger than maillog. I suspect a more historical reason in this case but I wasn't able to find it with google. – Zizzencs Aug 06 '12 at 09:26
  • If losing some logs didn't hurt, prefix with a minus sign to gain some performance. I don't think there is a historical reason here. – quanta Aug 06 '12 at 09:37
  • @Downvoter: please leave a comment to let me know why. – quanta Aug 06 '12 at 10:22
  • @Zizzencs a maillog should neither carry critical information nor be security-related so it typically should be safe to buffer writes for it. – the-wabbit Aug 06 '12 at 11:52