Hi sv and others,
logrotate may do the job, but I don't like that approach (requires
huping and is too loosely coupled for my taste).
There is a $outchannel directive in rsyslog, that can probably be
(ab)used for this use case:
http://www.rsyslog.com/module-Static_Docs-view-f-rsyslog_conf.html.phtml search for "Output Channels"
HOWEVER, $outchannel is legacy for a design idea that didn't work out.
It will be removed in the future (or probably be carried as a legacy
that will receive no further development). But it may still do the trick
in the very next time.
The real answer is different and there is good news. I am currently
implementing on disk-queueing including store-and-forward actions (e.g.
spool to disk if destination syslog server is unavailable and send the
spooled data as soon as it comes back on). I have made good progress
with that and hope to have the feature available by the end of the
month.
As a side-effect, I developed as stream class which can write circular
logs (and a number of other cool things). Once store-and-forward is
ready, I'll take that stream class and modify the output file writer to
utilize it. Then, circular logging will be available as a native
feature. I hope to have this ready by mid-February, of course, all
depending on how things progress...
The bad thing is that you'll probably see a number of oddly-looking
config directives, but for the time being I have given features
precedence over log file format. It may (may!) look like something along
these lines:
$ActionFileWriteMode circular
$ActionFileMaxSize 8192k
$ActionFileDir /var/log
$ActionFilePrefix messages
*.info;mail.none;authpriv.none;cron.none :omfile:
Yes, it is ugly ;) But it needs to fit into the currently available
config classes. You may cast your future config format ballot here:
http://rgerhards.blogspot.com/2007/08/on-rsyslog-config-file-format.html I have to admit, though, that I think it will be mid-2008 before I
revisit the config file format. After the output writer, full expression
support is the next major feature on my agenda.
Comments welcome,
Rainer
> -----Original Message-----
> From: rsyslog-bounces at lists.adiscon.com [mailto:rsyslog-
> bounces at lists.adiscon.com] On Behalf Of seth vidal
> Sent: Wednesday, January 16, 2008 3:54 PM
> To: rsyslog at lists.adiscon.com
> Subject: [rsyslog] ringbuffer log destination
>
> Would it be possible/easy to setup a ringbuffer log destination? Like
> dmesg under linux it would be very useful to me to have a ringbuffer
> log. On my laptop, for example, I don't often need more than the last
> 30-60 minutes of logs for fixing problems. And it'd make it more
> possible to have limited logs if we could do something in rsyslog
like:
>
> *.info;mail.none;authpriv.none;cron.none
ringbuffer(/var/log/messages,
> 8192)
>
> I was actually thinking about using an SD card or usb key as my 'hard
> drive' and I want to limit unnecessary writes. So, if I could log
> to /dev/shm and limit the total size of the logs via ringbuffer to 10M
> or 20M then I'd not eat up much memory and none of the writes would be
> to media with a limited write count.
>
> Would this be something you'd consider adding? Or maybe I've not
looked
> hard enough and it's available now?
>
> Thanks,
> -sv
>
>
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog