[syslog-ng]Re: offline mode?

[Jeremy Mates]

* Russell Adams <RLAdams@Kelsey-Seybold.com>
> I'd use a tree style log directory
> (/var/log/HOSTS/hostname/yyyy/mm/dd/loglevel), and then rsync to your
> central server when a connection is available.

Agreed, though for laptops using a hostname might be difficult; the
hostname of my OS X laptop changes quite often. Maybe set a hostname or
other ID to use via a configuration system instead of using the
"official" hostname.

> That way you're syncing full files, not one monolithic log file that
> changes while you read it.

Yes, messages.x rotation does not work at all with rsync.