Caching in syslog

If the path of the logs in syslog config starts with the minus (-) sign, that tells syslog that it doesn't need to perform sync operation for each log message.

This is sometimes called caching mode.

When using a caching mode, some messages can be lost if system crashes immediately after write attempt.

However you might see performance improvements during normal operations if you have system with many logfiles.

Example of caching rule - usually used for less critical messages:

mail.info -/var/log/mail.info