[runit/svlogd] RFE: periodic log-rotation; filter-malfunction

[Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de>]

Hello,

I am using svlogd 1.0.2 + socklog 1.5.0 which are great programs. But I
miss a small feature: I am using network logging and have some hosts
with a small log-volume. On these, the logrotation (configured with
's4096') happens very seldom (perhaps 3-4 times per day) and I would
miss important messages when evaluating the logs on the loghost.

Because the transfer is expensive (piped into stunnel), and I want to
share the configuration with other hosts with a higher log-volume, I do
not want to play with the 's....' parameter.

Would it be possible to add another option (e.g. 'a<seconds>') which
sends SIGALRM at <seconds> seconds after the last logrotation?



Another issue: the '-/+...' filters seem to fail sometimes. E.g. I have

in main/config
| -*: @* mail.*: *

and in mail/config
| -*
| +*: @* mail.*: *


These rules are working the most time, but I see single message like

| @400000004136debc1e6b394c mailbox: @400000004136db9604ff84a4 mail.notice: Sep  2 10:36:28 imap[9964]: login: ...

in main/current. This message is missing in mail/current, but other ones
transfered in the same logrotation at 'mailbox' are in mail/current as
expected.

I guess this has something to do with wrapping buffers (mailbox has the
's4096' setting), but I can not give a reproducible example.




Enrico