fixed-size log outputs

January 16, 2008

Dear Lazyweb,

I was trying to figure out if it would be possible to have a fixed-length syslog destination file. It was part of a thought about doing limited syslogging for a system installed on a usb key or on sd-card. I’d want some logging but I’d really only need the last 30 minutes to an hour (or so). It would be fantastic if I could allocate 50-100MB of ram to it and have the logs populate that space but when they area began to fill up they just dumped out the oldest log entry.

Anyone know of a way to do this or a better idea? I know I can just turn off logging for my laptop and I could probably get away with dropping 2GB of ram or more in my laptop and mounting /var/log into /dev/shm but I was thinking of a way to do it that we could maybe make into a simple syslog config.

So, ideas? Anyone?

7 Responses to “fixed-size log outputs”

  1. Tyler Says:

    I know with syslog-ng you can roll to a new file every hour, minute, etc. You could roll to a new file every hour and delete the previous one using cron. I don’t know if rsyslog can do that though??

  2. Lalufu Says:

    The openwrt people have a logger which logs into a memory ringbuffer of configurable size. I am not sure if that’s a feature of busybox or a separate package (and I can’t look since my router is currently down🙂

  3. Andrew Says:

    Here is a RAM oriented syslog with dumps to disks on a predefined schedule :

    http://freshmeat.net/projects/ramlog/?branch_id=72960&release_id=269765

  4. Michael Says:

    I just confirmed, this is possible with rsyslog using outchannel.

    Put something like this to rsyslog.conf:

    #start log rotation via outchannel
    $outchannel log_rotation,/var/log/log_rotation.log,52428800,/home/mm/./logrot

    *.* $log_rotation
    #end log rotation

    /home/mm/logrot is a simple script with a single command:
    mv -f /var/log/log_rotation.log /var/log/log_rotation.log.1

    This is a kind of circular logging approach. In short: rsyslog always writes to log_rotation.log. If log_rotation.log reaches 50 mb, the file is moved to log_rotation.log.1. With this 100 mb are the maximum amount which is used for logging.

    cheers

  5. Michael Says:

    Just want inform you that I have created a small article for rsyslog based on your notes http://www.rsyslog.com/module-Static_Docs-view-f-log_rotation_fix_size.html.phtml

  6. skvidal Says:

    Michael,
    very nice. It’s good we can get to this feature w/o having to use another logger.


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: