* Re: Socklog feature request
[not found] ` <20040808112240.3636.qmail@678ff29a1e7219.315fe32.mid.smarden.org>
@ 2004-08-08 14:28 ` Alexander Lazic
2004-08-08 17:09 ` Gerrit Pape
0 siblings, 1 reply; 3+ messages in thread
From: Alexander Lazic @ 2004-08-08 14:28 UTC (permalink / raw)
On Son 08.08.2004 11:22, Gerrit Pape wrote:
>On Sat, Aug 07, 2004 at 10:48:00AM +0200, Alexander Lazic wrote:
>
> http://marc.theaimsgroup.com/?t=104379616100007&r=1&w=2
> http://marc.theaimsgroup.com/?t=104064482600002&r=1&w=2
Thanx for the links ;-)
>> I need to rotate the logs per day but haven't found a easy way to do
>> this with socklog.
>
>Why do you need? I would advise to make use of the great feature of
>multilog and svlogd that allows you to calculate the maximum space used
>for logs. If you rotate logs on a daily basis only, you cannot ensure
>this limit; a service (probably misconfigured or broken) can produce a
>huge amount of logs in one day.
The filesize is not my problem. When i look into the file of e.g Friday
then i want _all_ data from Friday are in one logfile, if it is 1GB or
whatever it is so.
As i know the multilog and svlogd read from stdin nor?
al ;-)
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: Socklog feature request
2004-08-08 14:28 ` Socklog feature request Alexander Lazic
@ 2004-08-08 17:09 ` Gerrit Pape
2004-08-08 18:00 ` Michael J. Forster
0 siblings, 1 reply; 3+ messages in thread
From: Gerrit Pape @ 2004-08-08 17:09 UTC (permalink / raw)
On Sun, Aug 08, 2004 at 04:28:35PM +0200, Alexander Lazic wrote:
> On Son 08.08.2004 11:22, Gerrit Pape wrote:
> >http://marc.theaimsgroup.com/?t=104379616100007&r=1&w=2
> >http://marc.theaimsgroup.com/?t=104064482600002&r=1&w=2
> Thanx for the links ;-)
> >>I need to rotate the logs per day but haven't found a easy way to do
> >>this with socklog.
> >Why do you need? I would advise to make use of the great feature of
> The filesize is not my problem. When i look into the file of e.g Friday
> then i want _all_ data from Friday are in one logfile, if it is 1GB or
> whatever it is so.
Hmm, I don't share your opinion, and warn that file size may very well
be a problem for you eventually.
Anyway, the links above should help you to do what you want
nevertheless; with svlogd it's simply disabling log file rotation by
size, and configuring a scheduler to send a signal at midnight.
> As i know the multilog and svlogd read from stdin nor?
They do.
Gerrit.
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: Socklog feature request
2004-08-08 17:09 ` Gerrit Pape
@ 2004-08-08 18:00 ` Michael J. Forster
0 siblings, 0 replies; 3+ messages in thread
From: Michael J. Forster @ 2004-08-08 18:00 UTC (permalink / raw)
On Sun, Aug 08, 2004 at 05:09:53PM +0000, Gerrit Pape wrote:
> On Sun, Aug 08, 2004 at 04:28:35PM +0200, Alexander Lazic wrote:
> > On Son 08.08.2004 11:22, Gerrit Pape wrote:
> > >http://marc.theaimsgroup.com/?t=104379616100007&r=1&w=2
> > >http://marc.theaimsgroup.com/?t=104064482600002&r=1&w=2
> > Thanx for the links ;-)
>
> > >>I need to rotate the logs per day but haven't found a easy way to do
> > >>this with socklog.
> > >Why do you need? I would advise to make use of the great feature of
>
> > The filesize is not my problem. When i look into the file of e.g Friday
> > then i want _all_ data from Friday are in one logfile, if it is 1GB or
> > whatever it is so.
I suggest separating the notions of log collection and analysis,
as would a database programmer the notions of physical and logical
data structure.
On the servers I manager, file sizes under /var/log are of concern.
I let multilog do its thing and, on a daily (or hourly, as necessary)
basis, I move any rotated logs to a place where space isn't a
concern. From there, some simple shell scripts can extract log
entries by date regardless of the files involved.
-Mike
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2004-08-08 18:00 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <20040807084800.GA7779@none.at>
[not found] ` <20040808112240.3636.qmail@678ff29a1e7219.315fe32.mid.smarden.org>
2004-08-08 14:28 ` Socklog feature request Alexander Lazic
2004-08-08 17:09 ` Gerrit Pape
2004-08-08 18:00 ` Michael J. Forster
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).