<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:st1="urn:schemas-microsoft-com:office:smarttags" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<!--[if !mso]>
<style>
v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style>
<![endif]--><o:SmartTagType
namespaceuri="urn:schemas-microsoft-com:office:smarttags" name="State"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="City"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="place"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="PersonName"/>
<!--[if !mso]>
<style>
st1\:*{behavior:url(#default#ieooui) }
</style>
<![endif]-->
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"Book Antiqua";
panose-1:2 4 6 2 5 3 5 3 3 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:blue;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Book Antiqua";
color:blue;
font-weight:normal;
font-style:normal;
text-decoration:none none;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Book Antiqua";
color:blue;
font-weight:normal;
font-style:normal;
text-decoration:none none;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.25in 1.0in 1.25in;}
div.Section1
{page:Section1;}
/* List Definitions */
@list l0
{mso-list-id:1948269139;
mso-list-type:hybrid;
mso-list-template-ids:-125530488 -966499668 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l0:level1
{mso-level-start-at:0;
mso-level-number-format:bullet;
mso-level-text:-;
mso-level-tab-stop:20.25pt;
mso-level-number-position:left;
margin-left:20.25pt;
text-indent:-.25in;
font-family:"Book Antiqua";
mso-fareast-font-family:"Times New Roman";
mso-bidi-font-family:"Times New Roman";}
@list l0:level2
{mso-level-tab-stop:1.0in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level3
{mso-level-tab-stop:1.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level4
{mso-level-tab-stop:2.0in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level5
{mso-level-tab-stop:2.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level6
{mso-level-tab-stop:3.0in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level7
{mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level8
{mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level9
{mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
-->
</style>
</head>
<body lang=EN-US link=blue vlink=blue>
<div class=Section1>
<p class=MsoNormal><font size=2 color=blue face="Book Antiqua"><span
style='font-size:10.0pt;font-family:"Book Antiqua";color:blue'>In fact, you
could even write this as a kernel module (which would give you direct access to
the list.h kernel header) and implement this behaviour right under the hood of
the OS rather than in Syslog-NG.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=blue face="Book Antiqua"><span
style='font-size:10.0pt;font-family:"Book Antiqua";color:blue'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=blue face="Book Antiqua"><span
style='font-size:10.0pt;font-family:"Book Antiqua";color:blue'>Basically, using
the Linux VFS and kernel module subsystems, you can create device files in
which the “write” operations behave in the manner listed below (writing
to a circular list implementation of X number of nodes). This would then
allow Syslog-NG to continuously write to the device file, and let the device
file’s implementation operate in the ring buffer manner outlined below.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=blue face="Book Antiqua"><span
style='font-size:10.0pt;font-family:"Book Antiqua";color:blue'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=blue face="Book Antiqua"><span
style='font-size:10.0pt;font-family:"Book Antiqua";color:blue'>I hope this
helps,<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=blue face="Book Antiqua"><span
style='font-size:10.0pt;font-family:"Book Antiqua";color:blue'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=blue face="Book Antiqua"><span
style='font-size:10.0pt;font-family:"Book Antiqua";color:blue'>Justin.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=blue face="Book Antiqua"><span
style='font-size:10.0pt;font-family:"Book Antiqua";color:blue'><o:p> </o:p></span></font></p>
<div>
<div class=MsoNormal align=center style='text-align:center'><font size=3
face="Times New Roman"><span style='font-size:12.0pt'>
<hr size=2 width="100%" align=center tabindex=-1>
</span></font></div>
<p class=MsoNormal><b><font size=2 face=Tahoma><span style='font-size:10.0pt;
font-family:Tahoma;font-weight:bold'>From:</span></font></b><font size=2
face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'> <st1:PersonName
w:st="on">Justin Randall</st1:PersonName> <br>
<b><span style='font-weight:bold'>Sent:</span></b> Tuesday, March 27, 2007 5:47
PM<br>
<b><span style='font-weight:bold'>To:</span></b> '<st1:PersonName w:st="on">Syslog-ng
users' and developers' mailing list</st1:PersonName>'<br>
<b><span style='font-weight:bold'>Subject:</span></b> RE: [syslog-ng] Log
rotate without log rotate.</span></font><o:p></o:p></p>
</div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=blue face="Book Antiqua"><span
style='font-size:10.0pt;font-family:"Book Antiqua";color:blue'>Depending on the
language you are using, if you have access to pointers (if you are using C/C++)
you can very efficiently implement this behaviour using a circular ring buffer.
Essentially this would involve a double-linked list implementation in which
the head node’s “prev” member references the tail node of the
list.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=blue face="Book Antiqua"><span
style='font-size:10.0pt;font-family:"Book Antiqua";color:blue'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=blue face="Book Antiqua"><span
style='font-size:10.0pt;font-family:"Book Antiqua";color:blue'>The list
implementation used in the Linux kernel (list.h in the kernel header files)
uses this type of list. Using this list implementation, you can have your
circular buffer by doing the following:<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=blue face="Book Antiqua"><span
style='font-size:10.0pt;font-family:"Book Antiqua";color:blue'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='margin-left:20.25pt;text-indent:-.25in;mso-list:l0 level1 lfo2'><![if !supportLists]><font
size=2 color=blue face="Book Antiqua"><span style='font-size:10.0pt;font-family:
"Book Antiqua";color:blue'><span style='mso-list:Ignore'>-<font size=1
face="Times New Roman"><span style='font:7.0pt "Times New Roman"'>
</span></font></span></span></font><![endif]><font size=2 color=blue
face="Book Antiqua"><span style='font-size:10.0pt;font-family:"Book Antiqua";
color:blue'>Create a list with 100 nodes, each node representing a
“line” of logging text.<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-left:20.25pt;text-indent:-.25in;mso-list:l0 level1 lfo2'><![if !supportLists]><font
size=2 color=blue face="Book Antiqua"><span style='font-size:10.0pt;font-family:
"Book Antiqua";color:blue'><span style='mso-list:Ignore'>-<font size=1
face="Times New Roman"><span style='font:7.0pt "Times New Roman"'>
</span></font></span></span></font><![endif]><font size=2 color=blue
face="Book Antiqua"><span style='font-size:10.0pt;font-family:"Book Antiqua";
color:blue'>Create an integrator-type pointer used to traverse the list.<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-left:20.25pt;text-indent:-.25in;mso-list:l0 level1 lfo2'><![if !supportLists]><font
size=2 color=blue face="Book Antiqua"><span style='font-size:10.0pt;font-family:
"Book Antiqua";color:blue'><span style='mso-list:Ignore'>-<font size=1
face="Times New Roman"><span style='font:7.0pt "Times New Roman"'>
</span></font></span></span></font><![endif]><font size=2 color=blue
face="Book Antiqua"><span style='font-size:10.0pt;font-family:"Book Antiqua";
color:blue'>Each node contains a “next” and a “prev”
pointer which reference the next or previous node in the list.<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-left:20.25pt;text-indent:-.25in;mso-list:l0 level1 lfo2'><![if !supportLists]><font
size=2 color=blue face="Book Antiqua"><span style='font-size:10.0pt;font-family:
"Book Antiqua";color:blue'><span style='mso-list:Ignore'>-<font size=1
face="Times New Roman"><span style='font:7.0pt "Times New Roman"'>
</span></font></span></span></font><![endif]><font size=2 color=blue
face="Book Antiqua"><span style='font-size:10.0pt;font-family:"Book Antiqua";
color:blue'>When writing a line, modify the text line for the node currently
referenced by the integrator pointer, and the advance the iterator to the value
of the “next” pointer for the current node.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=blue face="Book Antiqua"><span
style='font-size:10.0pt;font-family:"Book Antiqua";color:blue'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=blue face="Book Antiqua"><span
style='font-size:10.0pt;font-family:"Book Antiqua";color:blue'>Using this
logic, the middle-application will be very compact, as it does not need any
program logic to determine if it is in need to dump old data for new data.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=blue face="Book Antiqua"><span
style='font-size:10.0pt;font-family:"Book Antiqua";color:blue'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=blue face="Book Antiqua"><span
style='font-size:10.0pt;font-family:"Book Antiqua";color:blue'>You may have
already gone down this path, and if so I apologize for the long-winded email,
though I hope this is helpful in writing a light-weight middle-app.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=blue face="Book Antiqua"><span
style='font-size:10.0pt;font-family:"Book Antiqua";color:blue'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=blue face="Book Antiqua"><span
style='font-size:10.0pt;font-family:"Book Antiqua";color:blue'>Regards,<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=blue face="Book Antiqua"><span
style='font-size:10.0pt;font-family:"Book Antiqua";color:blue'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=blue face="Book Antiqua"><span
style='font-size:10.0pt;font-family:"Book Antiqua";color:blue'>Justin.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=blue face="Book Antiqua"><span
style='font-size:10.0pt;font-family:"Book Antiqua";color:blue'><o:p> </o:p></span></font></p>
<div>
<div class=MsoNormal align=center style='text-align:center'><font size=3
face="Times New Roman"><span style='font-size:12.0pt'>
<hr size=2 width="100%" align=center tabindex=-1>
</span></font></div>
<p class=MsoNormal><b><font size=2 face=Tahoma><span style='font-size:10.0pt;
font-family:Tahoma;font-weight:bold'>From:</span></font></b><font size=2
face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'> Bruno Vieira
[mailto:giuliapo@gmail.com] <br>
<b><span style='font-weight:bold'>Sent:</span></b> Saturday, March 17, 2007
12:58 PM<br>
<b><span style='font-weight:bold'>To:</span></b> <st1:PersonName w:st="on">Syslog-ng
users' and developers' mailing list</st1:PersonName><br>
<b><span style='font-weight:bold'>Subject:</span></b> Re: [syslog-ng] Log
rotate without log rotate.</span></font><o:p></o:p></p>
</div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='margin-bottom:12.0pt'><font size=3
face="Times New Roman"><span style='font-size:12.0pt'>Hi there. Thank you for
your opinion.<br>
<br>
I have found that this really is a feature well needed by many embeddedsystems.<br>
<br>
I will implement or reuse a component that makes this kind of rotation... the
conclusion i got was that what I really needed was a file that would implement
a buffer... so, the only way is making a daemon that does this for me.. and it
may or may not save it's buffer on a destination file. <br>
<br>
It would be great if Linux had a driver that would do this on it's own. Or at
least a driver on the project openwrt (linux for embedded systems).<br>
<br>
Well, I have the solution now :)<br>
<br>
Thanks you all for your contribution. <br>
Many regards,<br>
Bruno.<br>
<br>
<br>
<br>
<o:p></o:p></span></font></p>
<div>
<p class=MsoNormal><span class=gmailquote><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>On 17 Mar 2007 16:25:32 +0000, <b><span
style='font-weight:bold'>Bryan Henderson</span></b> <<a
href="mailto:bryanh@giraffe-data.com">bryanh@giraffe-data.com </a>> wrote:</span></font></span><o:p></o:p></p>
<p class=MsoNormal style='margin-bottom:12.0pt'><font size=3
face="Times New Roman"><span style='font-size:12.0pt'>>I have a solution.. but
I think there can be a better one. My solution is: <br>
>having a midlle program between syslog-ng and the destination file. And for<br>
>every message received, the program would verify if the destination file<br>
>(p.e. auth.log) already has 100 lines. If so, deleted the last line, make <br>
>all others one ENTER down and that append the new line to the beginning of<br>
>the file.<br>
<br>
It would probably be better to maintain the file in circular fashion:<br>
allocate 8K in the beginning, then write messages from beginning to <br>
end, then wrap around and write from the beginning again, always<br>
keeping track (in a header of the file) of where you last wrote. Use<br>
a special program that understands this file format to translate it to<br>
a regular stream that you can use normally. <br>
<br>
Lots of systems have programs that do this. I looked on Freshmeat
for<br>
a publicly available one and found 'cupyvei', though I don't much care<br>
for the details of this implementation. It would be easy to write a <br>
program of your own.<br>
<br>
I also think a built in log destination of this type<br>
(e.g. "file_circular") would be an excellent addition to
syslog-ng. I<br>
think this type of logging is a common requirement. <br>
<br>
--<br>
Bryan
Henderson
<st1:City w:st="on">San Jose</st1:City>, <st1:place w:st="on"><st1:State w:st="on">California</st1:State></st1:place><br>
_______________________________________________<br>
syslog-ng maillist - <a
href="mailto:syslog-ng@lists.balabit.hu">syslog-ng@lists.balabit.hu </a><br>
<a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Frequently asked questions at <a href="http://www.campin.net/syslog-ng/faq.html">http://www.campin.net/syslog-ng/faq.html
</a><o:p></o:p></span></font></p>
</div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
</div>
</body>
</html>