fixed-size log outputs
January 16, 2008
Dear Lazyweb,
I was trying to figure out if it would be possible to have a fixed-length syslog destination file. It was part of a thought about doing limited syslogging for a system installed on a usb key or on sd-card. I’d want some logging but I’d really only need the last 30 minutes to an hour (or so). It would be fantastic if I could allocate 50-100MB of ram to it and have the logs populate that space but when they area began to fill up they just dumped out the oldest log entry.
Anyone know of a way to do this or a better idea? I know I can just turn off logging for my laptop and I could probably get away with dropping 2GB of ram or more in my laptop and mounting /var/log into /dev/shm but I was thinking of a way to do it that we could maybe make into a simple syslog config.
So, ideas? Anyone?
journal/notes 
January 16, 2008 at 5:02 am
[…] https://skvidal.wordpress.com/2008/01/16/fixed-size-log-outputs/ asks Hoosgot, […]
January 16, 2008 at 12:26 pm
I know with syslog-ng you can roll to a new file every hour, minute, etc. You could roll to a new file every hour and delete the previous one using cron. I don’t know if rsyslog can do that though??
January 16, 2008 at 2:17 pm
The openwrt people have a logger which logs into a memory ringbuffer of configurable size. I am not sure if that’s a feature of busybox or a separate package (and I can’t look since my router is currently down 🙂
January 16, 2008 at 4:04 pm
Here is a RAM oriented syslog with dumps to disks on a predefined schedule :
http://freshmeat.net/projects/ramlog/?branch_id=72960&release_id=269765
January 17, 2008 at 4:32 pm
I just confirmed, this is possible with rsyslog using outchannel.
Put something like this to rsyslog.conf:
#start log rotation via outchannel
$outchannel log_rotation,/var/log/log_rotation.log,52428800,/home/mm/./logrot
*.* $log_rotation
#end log rotation
/home/mm/logrot is a simple script with a single command:
mv -f /var/log/log_rotation.log /var/log/log_rotation.log.1
This is a kind of circular logging approach. In short: rsyslog always writes to log_rotation.log. If log_rotation.log reaches 50 mb, the file is moved to log_rotation.log.1. With this 100 mb are the maximum amount which is used for logging.
cheers
January 18, 2008 at 2:38 pm
Just want inform you that I have created a small article for rsyslog based on your notes http://www.rsyslog.com/module-Static_Docs-view-f-log_rotation_fix_size.html.phtml
January 18, 2008 at 2:51 pm
Michael,
very nice. It’s good we can get to this feature w/o having to use another logger.