Re: Socklog feature request

Re: Socklog feature request

[Alexander Lazic]

On Son 08.08.2004 11:22, Gerrit Pape wrote:
>On Sat, Aug 07, 2004 at 10:48:00AM +0200, Alexander Lazic wrote:
>
> http://marc.theaimsgroup.com/?t=104379616100007&r=1&w=2
> http://marc.theaimsgroup.com/?t=104064482600002&r=1&w=2

Thanx for the links ;-)

>> I need to rotate the logs per day but haven't found a easy way to do
>> this with socklog.
>
>Why do you need?  I would advise to make use of the great feature of
>multilog and svlogd that allows you to calculate the maximum space used
>for logs.  If you rotate logs on a daily basis only, you cannot ensure
>this limit; a service (probably misconfigured or broken) can produce a
>huge amount of logs in one day.

The filesize is not my problem. When i look into the file of e.g Friday
then i want _all_ data from Friday are in one logfile, if it is 1GB or
whatever it is so.

As i know the multilog and svlogd read from stdin nor?

al ;-)

Re: Socklog feature request

[Gerrit Pape]

On Sun, Aug 08, 2004 at 04:28:35PM +0200, Alexander Lazic wrote:
> On Son 08.08.2004 11:22, Gerrit Pape wrote:
> >http://marc.theaimsgroup.com/?t=104379616100007&r=1&w=2
> >http://marc.theaimsgroup.com/?t=104064482600002&r=1&w=2
> Thanx for the links ;-)

> >>I need to rotate the logs per day but haven't found a easy way to do
> >>this with socklog.
> >Why do you need?  I would advise to make use of the great feature of

> The filesize is not my problem. When i look into the file of e.g Friday
> then i want _all_ data from Friday are in one logfile, if it is 1GB or
> whatever it is so.

Hmm, I don't share your opinion, and warn that file size may very well
be a problem for you eventually.

Anyway, the links above should help you to do what you want
nevertheless; with svlogd it's simply disabling log file rotation by
size, and configuring a scheduler to send a signal at midnight.

> As i know the multilog and svlogd read from stdin nor?
They do.

Gerrit.

Re: Socklog feature request

[Michael J. Forster]

On Sun, Aug 08, 2004 at 05:09:53PM +0000, Gerrit Pape wrote:
> On Sun, Aug 08, 2004 at 04:28:35PM +0200, Alexander Lazic wrote:
> > On Son 08.08.2004 11:22, Gerrit Pape wrote:
> > >http://marc.theaimsgroup.com/?t=104379616100007&r=1&w=2
> > >http://marc.theaimsgroup.com/?t=104064482600002&r=1&w=2
> > Thanx for the links ;-)
> 
> > >>I need to rotate the logs per day but haven't found a easy way to do
> > >>this with socklog.
> > >Why do you need?  I would advise to make use of the great feature of
> 
> > The filesize is not my problem. When i look into the file of e.g Friday
> > then i want _all_ data from Friday are in one logfile, if it is 1GB or
> > whatever it is so.

I suggest separating the notions of log collection and analysis,
as would a database programmer the notions of physical and logical
data structure.

On the servers I manager, file sizes under /var/log are of concern.
I let multilog do its thing and, on a daily (or hourly, as necessary)
basis, I move any rotated logs to a place where space isn't a
concern.  From there, some simple shell scripts can extract log
entries by date regardless of the files involved.

-Mike