[syslog-ng] Re: Log rotate without log rotate.

[G.W. Haywood]

Hi there,

On Fri, 16 Mar 2007 Bruno Vieira wrote:

> ... the problem here is that the device that will be logging have memory
> restrictions.
> So, I want a log that acts as a fifo. And every time a new message comes,
> the oldest one gets out.
> ...
> I would like to have only one file per destination (ex: auth.log) and keep
> that file within 100 - 120 KB or 100 lines, per example. I want it to be
> circular... to be like a FIFO.

Why don't you just log to a remote host?

> I have a solution.. but I think there can be a better one. My solution is:
> having a midlle program between syslog-ng and the destination file. And for
> every message received, the program would verify if the destination file (
> p.e. auth.log) already has 100 lines. If so, deleted the last line, make all
> others one ENTER down and that append the new line to the beginning of the
> file.

Don't do it like that.  Your 'middle program' might bring the machine
to its knees if syslog gets a lot of messages.  You could write a
script which stores 100 lines in a buffer and deletes the oldest line
every time a new line comes in, and make it respond to a signal (for
example SIGHUP) by writing its entire buffer to a screen or to a file.

> But this seems to be a very "manual" solution...

It is.

--

73,
Ged.