Re: Socklog feature request

["Michael J. Forster" <mike@sharedlogic.ca>]

On Sun, Aug 08, 2004 at 05:09:53PM +0000, Gerrit Pape wrote:
> On Sun, Aug 08, 2004 at 04:28:35PM +0200, Alexander Lazic wrote:
> > On Son 08.08.2004 11:22, Gerrit Pape wrote:
> > >http://marc.theaimsgroup.com/?t=104379616100007&r=1&w=2
> > >http://marc.theaimsgroup.com/?t=104064482600002&r=1&w=2
> > Thanx for the links ;-)
> 
> > >>I need to rotate the logs per day but haven't found a easy way to do
> > >>this with socklog.
> > >Why do you need?  I would advise to make use of the great feature of
> 
> > The filesize is not my problem. When i look into the file of e.g Friday
> > then i want _all_ data from Friday are in one logfile, if it is 1GB or
> > whatever it is so.

I suggest separating the notions of log collection and analysis,
as would a database programmer the notions of physical and logical
data structure.

On the servers I manager, file sizes under /var/log are of concern.
I let multilog do its thing and, on a daily (or hourly, as necessary)
basis, I move any rotated logs to a place where space isn't a
concern.  From there, some simple shell scripts can extract log
entries by date regardless of the files involved.

-Mike