Submit a ticketCall us

Systems Monitoring for Dummies
Our new eBook will teach you the fundamentals and help you create monitors and alerts that are effective, meaningful, and actionable. Monitoring is more than a checkbox on your to-do list. This free eBook will give you practical advice to help you succeed in all aspects of monitoring – discovery, alerting, remediation, and troubleshooting. Don’t miss out on this indispensable resource for newbies, experienced IT pros, and everyone in between. Register Now.

Home > Success Center > Kiwi Syslog Server > Kiwi Syslog Server Administrator Guide > Registry settings for Kiwi Syslog Server > File write caching settings

File write caching settings

Use the following Kiwi Syslog Server registry settings to enable and configure file write caching. File write caching considerably improves the performance of the "Log to file" action under heavy message load.

When enabled, the "Log to File" action will cache the output data for X seconds or X messages before writing to the log file. The data is cached in memory until the log file is updated in bulk. This is more efficient than writing a single message to a file as it arrives.

There is a separate memory cache for each output file. In most cases there is only a single output file, but if AutoSplit or filters are used to split the messages into separate files, there could be additional active output files.

When an output file cache is not being used X seconds, the cache is destroyed to save resources.

When the program shuts down, all the caches are written to the appropriate files so that no data is lost.

FileWriteCacheEnabled

Use this setting to enable or disable file write caching. When enabled, the "Log to File" action will cache the output data for X seconds or X messages before writing to the log file. The data is cached in memory and the log file is updated in bulk. This is more efficient than writing a single message to a file as it arrives.

Section (32-bit Windows OS)HKEY_LOCAL_MACHINE\SOFTWARE\SolarWinds\Syslogd\Properties
Section (64-bit Windows OS)HKEY_LOCAL_MACHINE\Software\WOW6432Node\SolarWinds\Syslogd\Properties
Value (STRING)FileWriteCacheEnabled
Min value0
Max value1
Default value1
TypeEnabled = 1, Disabled = 0

FileWriteCacheTimeout

Use this setting to specify the timeout in seconds. After the timeout period the contents of the cache are written to disk. The timer is started when the first message arrives in the cache. If the cache is not full and has not been flushed before the timeout period has expired, the cache will be flushed automatically. This value sets the maximum time that the cache will hold a message before writing it to disk. The less frequently the disk is written to, the more efficient the file logging process becomes.

Section (32-bit Windows OS)HKEY_LOCAL_MACHINE\SOFTWARE\SolarWinds\Syslogd\Properties
Section (64-bit Windows OS)HKEY_LOCAL_MACHINE\Software\WOW6432Node\SolarWinds\Syslogd\Properties
Value (STRING)FileWriteCacheTimeout
Min value1
Max value120
Default value5
Type

Timeout in seconds

FileWriteCacheEntries

Use this setting to specify the maximum number of messages to be cached for each output file before being written to file. Messages are added to the cache until the maximum is reached or the timeout period elapses. The less frequently the disk is written to, the more efficient the file logging process becomes. The messages are stored in memory in UNICODE which requires two bytes for each character in the message. For example, a 100 character message requires 200 bytes of memory for storage.

Section (32-bit Windows OS)HKEY_LOCAL_MACHINE\SOFTWARE\SolarWinds\Syslogd\Properties
Section (64-bit Windows OS)HKEY_LOCAL_MACHINE\Software\WOW6432Node\SolarWinds\Syslogd\Properties
Value (STRING)FileWriteCacheEntries
Min value10
Max value100000
Default value1000
TypeMaximum number of cache entries (messages)

FileWriteCacheMaxSizeKB

Use this setting to specify the maximum cache size in KBytes. When the cache exceeds this size, it is written to file. Messages are added to the cache until the maximum memory size is reached or the timeout period elapses. The less frequently the disk is written to, the more efficient the file logging process becomes. The messages are stored in memory in UNICODE which requires two bytes for each character in the message. For example, a 100 character message requires 200 bytes of memory for storage. If you experience any "Out of Memory" errors, lower this value or disable the file write caching.

Section (32-bit Windows OS)HKEY_LOCAL_MACHINE\SOFTWARE\SolarWinds\Syslogd\Properties
Section (64-bit Windows OS)HKEY_LOCAL_MACHINE\Software\WOW6432Node\SolarWinds\Syslogd\Properties
Value (STRING)FileWriteCacheMaxSizeKB
Min value1
Max value2000
Default value50
TypeMaximum size in KBytes for each cache

FileWriteCacheCleanup

Use this setting to specify the time (in minutes) that a cache can inactive before being destroyed. When a cache becomes inactive and is not receiving any further messages, the cleanup process will destroy the cache to free up resources. No data is lost because the cleanup process only destroys inactive caches that have already been written to file.

Section (32-bit Windows OS)HKEY_LOCAL_MACHINE\SOFTWARE\SolarWinds\Syslogd\Properties
Section (64-bit Windows OS)HKEY_LOCAL_MACHINE\Software\WOW6432Node\SolarWinds\Syslogd\Properties
Value (STRING)FileWriteCacheCleanup
Min value10
Max value1440
Default value10
TypeTime (in minutes) that a cache can inactive before being destroyed

FileWriteCacheFileLock

Use this setting to enable or disable log file locking.

For efficiency and security reasons, the log files can be held open in "append shared" mode. This improves efficiency by not having to open and close the file with each write. While the file is held open, not other application can modify or delete the contents. Only new entries can be added to the file. The files can be opened for viewing, but not for modification.

If you are receiving high syslog message traffic, enable this option to improve performance. The only drawback is that the file may not immediately show the new log entries. The OS will cache the data until the internal buffers are full then it will write the buffers to file. Under heavy load, this happens immediately, but when traffic is low, it can take a while for the buffers to fill and the data to be written. The log file is automatically updated and closed when the cache has been inactive for FileWriteCacheCleanup minutes.

Section (32-bit Windows OS)HKEY_LOCAL_MACHINE\SOFTWARE\SolarWinds\Syslogd\Properties
Section (64-bit Windows OS)HKEY_LOCAL_MACHINE\Software\WOW6432Node\SolarWinds\Syslogd\Properties
Value (STRING)FileWriteCacheFileLock
Min value0
Max value1
Default value0
TypeEnabled = 1, Disabled = 0

FileWriteCacheOpenFiles

When FileWriteCacheFileLock is set to 1 (enabled), each log file is held open in "append shared" mode. The program can only open a maximum of 255 files at once.

Use this value to set the maximum number of concurrently open files. Once this limit is reached, the FileWriteCacheFileLock value for the current cache is disabled. Log files will then be opened and closed with each cache write. If the Log to File action uses the AutoSplit syntax to create separate files for each logging host, it is possible that more than 255 files could be opened at once (assuming more than 255 actively sending hosts). A value of 100 files is recommended to keep system resource usage to a reasonable level.

Section (32-bit Windows OS)HKEY_LOCAL_MACHINE\SOFTWARE\SolarWinds\Syslogd\Properties
Section (64-bit Windows OS)HKEY_LOCAL_MACHINE\Software\WOW6432Node\SolarWinds\Syslogd\Properties
Value (STRING)FileWriteCacheOpenFiles
Min value1
Max value250
Default value100
TypeMaximum number of open file handles
Last modified

Tags

Classifications

Public