Hi sv and others, logrotate may do the job, but I don't like that approach (requires huping and is too loosely coupled for my taste).
There is a $outchannel directive in rsyslog, that can probably be (ab)used for this use case: http://www.rsyslog.com/module-Static_Docs-view-f-rsyslog_conf.html.phtml search for "Output Channels" HOWEVER, $outchannel is legacy for a design idea that didn't work out. It will be removed in the future (or probably be carried as a legacy that will receive no further development). But it may still do the trick in the very next time. The real answer is different and there is good news. I am currently implementing on disk-queueing including store-and-forward actions (e.g. spool to disk if destination syslog server is unavailable and send the spooled data as soon as it comes back on). I have made good progress with that and hope to have the feature available by the end of the month. As a side-effect, I developed as stream class which can write circular logs (and a number of other cool things). Once store-and-forward is ready, I'll take that stream class and modify the output file writer to utilize it. Then, circular logging will be available as a native feature. I hope to have this ready by mid-February, of course, all depending on how things progress... The bad thing is that you'll probably see a number of oddly-looking config directives, but for the time being I have given features precedence over log file format. It may (may!) look like something along these lines: $ActionFileWriteMode circular $ActionFileMaxSize 8192k $ActionFileDir /var/log $ActionFilePrefix messages *.info;mail.none;authpriv.none;cron.none :omfile: Yes, it is ugly ;) But it needs to fit into the currently available config classes. You may cast your future config format ballot here: http://rgerhards.blogspot.com/2007/08/on-rsyslog-config-file-format.html I have to admit, though, that I think it will be mid-2008 before I revisit the config file format. After the output writer, full expression support is the next major feature on my agenda. Comments welcome, Rainer > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:rsyslog- > [EMAIL PROTECTED] On Behalf Of seth vidal > Sent: Wednesday, January 16, 2008 3:54 PM > To: [email protected] > Subject: [rsyslog] ringbuffer log destination > > Would it be possible/easy to setup a ringbuffer log destination? Like > dmesg under linux it would be very useful to me to have a ringbuffer > log. On my laptop, for example, I don't often need more than the last > 30-60 minutes of logs for fixing problems. And it'd make it more > possible to have limited logs if we could do something in rsyslog like: > > *.info;mail.none;authpriv.none;cron.none ringbuffer(/var/log/messages, > 8192) > > I was actually thinking about using an SD card or usb key as my 'hard > drive' and I want to limit unnecessary writes. So, if I could log > to /dev/shm and limit the total size of the logs via ringbuffer to 10M > or 20M then I'd not eat up much memory and none of the writes would be > to media with a limited write count. > > Would this be something you'd consider adding? Or maybe I've not looked > hard enough and it's available now? > > Thanks, > -sv > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog
