From wernli@in2p3.fr Wed Mar 27 12:16:04 2013 Received: from ccsrelay01.in2p3.fr (ccsrelay01.in2p3.fr [134.158.66.51]) by underdog.stansell.org (8.14.5/8.14.5) with ESMTP id r2RCFura006904 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Wed, 27 Mar 2013 12:16:03 GMT Received: from ccswiss.in2p3.fr (ccswissrp.in2p3.fr [134.158.71.221]) (authenticated bits=0) by ccsrelay01.in2p3.fr (8.14.2/8.14.2/IN2P3) with ESMTP id r2RCFseY023284 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Wed, 27 Mar 2013 13:15:55 +0100 X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.97.5 at ccsrelay01 Received: by ccswiss.in2p3.fr (Postfix, from userid 3942) id 084493B1; Wed, 27 Mar 2013 13:15:55 +0100 (CET) Date: Wed, 27 Mar 2013 13:15:55 +0100 From: Fabien Wernli To: users@conserver.com Subject: Syslog vs. fifo Message-ID: <20130327121553.GG8241@ccswiss.in2p3.fr> Mail-Followup-To: users@conserver.com MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Organization: CC-IN2P3 (CNRS) User-Agent: Mutt/1.5.21 (2010-09-15) X-Spam-Score: -2.052 () BAYES_00,RP_MATCHES_RCVD X-Scanned-By: MIMEDefang 2.72 on 198.151.248.21 X-BeenThere: users@conserver.com X-Mailman-Version: 2.1.12 Precedence: list Reply-To: users@conserver.com List-Id: Conserver Users List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Mar 2013 12:16:04 -0000 Hi, * Problem: - We want all console logs on a central server for: . easy centralized access . activity monitoring (log analyzer) - preferrably with one file per console * Our current solution: - conserver runs on all conservers, using '-U/path/to/fifo' - syslog-ng reads from that fifo and sends data to centralized log server after prefixing "by-console/" to progname - centralized log server runs syslog-ng, which handles the analyzer and the split back to seperate files (e.g. '/path/to/log/by-console/serverXY') This solution has served us well, but has the following major drawback: when multiple consoles are generating output, they sometimes get mixed up in the fifo and syslog fails in separating them (matching string "by-console/..."). Also if at the same time a slash character is output by chance by one of the console, syslog-ng creates a subdir, etc. I'm open for suggestions on how to improve this, and also wondering if syslog support is planned, which would certainly help a lot. Cheers