[syslog-ng] log file size limit

[Gergely Nagy]

Gergely Nagy <algernon at balabit.hu> writes:

> Balazs Scheidler <bazsi at balabit.hu> writes:
>
>> On Mon, 2011-07-25 at 20:46 +0200, Gergely Nagy wrote:
>>> Sergei Zhirikov <sfzhi at yahoo.com> writes:
>>> >>> I posted that patch in this list quite some time ago, but as far as I can tell, it went unnoticed...
>>> >>
>>> >> Can you please post it again? I'd love to have a look.
>>> >>
>>> >
>>> > Attached.
>>> 
>>> Thank you, I will have a look hopefully within a day or two!
>>> 
>>> (Judging by the description, it sounds very useful & promising to me!)
>>> 
>>
>> any news on this?
>
> Not yet. Got caught up in DebConf stuff, and still not recovered. I'll
> have a go at it this coming friday.

Update: I'm halfway through. Applied the patch, made it compile, figured
out why it doesn't work (it modified LogTransportPlain to have a
callback, but nowadays we're using LogProtoFileWriter to write to files,
so the callback never gets called.

My first idea would be to port the patch to extend LogProtoFileWriter
instead of LogTransportPlain, but I'm not done figuring out how that
part of the code works, yet.

In any case, the patch itself looks good, there's only one thing I will
want to change after porting it to 3.3: I don't like how the renamed
file has a hard-coded template. I'd much rather introduce a second,
optional argument to size_limit(), which would be the template to rename
the old file to (defaulting to something like the current template,
which appends a timestamp and a random number).

However, adding such a template will need a bit more thinking, as I'll
need to pass down the neccessary structures to the callback.

Or perhaps, the callback could be rewritten to not do the actual file
reopening, just determine if we need to do that. And if so,
log_proto_writer_flush() would bubble up, we'd catch it somewhere in
affile, notice a flag the callback would set, and do the reopen, and
retry.

This way we have easy access to the message, and the callback would be
very lightweight.

I'll see what I can do about this.

-- 
|8]