Re: svlogd research

[George Georgalis <george@galis.org>]

On Fri, Nov 16, 2007 at 12:23:13PM -0800, Larry Doolittle wrote:
>Friends -
>
>On Fri, Nov 16, 2007 at 03:10:44PM -0500, Charlie Brady wrote:
>> On Fri, 16 Nov 2007, Larry Doolittle wrote:
>>
>>> I want both a reliable local log, and an encrypted (via stunnel) remote 
>>> log, where I can't control the reliability of the remote logging machine 
>>> (or the network path to it).
>>
>> My recommendation is that you log locally and periodically (often) mirror 
>> the log directory remotely.
>
>Interesting suggestion.  I can't easily use it, because I also don't
>control the software running on the remote logging machine -- it is
>syslogd wrapped in SSL, non-negotiable.

in addition to your local log dir, you could also write to a fifo
where another program reads and writes to your remote syslogd.
Of course if you loose the remote connection there could be a
blocking issue.

another way is to use a processor to send log entries at rotation
time, and sent the alarm signal to the log daemon at what ever
interval you need to keep the remote updated. again, if you cannot
connect there will be a block, when you try to alarm the next time.

yet another way is to use a processor to signal another program to
start the remote connection and dump the new logfile (by alarm if
necessary). that could be done any number of ways and wouldn't block
if it failed, but watch out that svlogd doesn't rotate away log files
that haven't been transferred yet.

// George


-- 
George Georgalis, information system scientist <IXOYE><