[Date Prev] [Date Index] [Date Next] [Thread Prev] [Thread Index] [Thread Next]

Syslog vs. fifo

Fabien Wernli wernli@in2p3.fr
Wed, 27 Mar 2013 12:16:03 GMT


* Problem:
  - We want all console logs on a central server for:
	  . easy centralized access
		. activity monitoring (log analyzer)
	- preferrably with one file per console

* Our current solution:
  - conserver runs on all conservers, using '-U/path/to/fifo'
	- syslog-ng reads from that fifo and sends data to centralized log server
	  after prefixing "by-console/" to progname
	- centralized log server runs syslog-ng, which handles the analyzer and
		the split back to seperate files (e.g. '/path/to/log/by-console/serverXY')

This solution has served us well, but has the following major drawback:
when multiple consoles are generating output, they sometimes get mixed up in
the fifo and syslog fails in separating them (matching string "by-console/...").
Also if at the same time a slash character is output by chance by one of the
console, syslog-ng creates a subdir, etc.

I'm open for suggestions on how to improve this, and also wondering if
syslog support is planned, which would certainly help a lot.