One technique I have used for catalina.out (tomcat) is to write to a named pipe, then read the named pipe with logger or a tail -F piped to logger.
Example: If you know the application will not issue a close(), then you can have logger directly read the pipe. CATALINA_OUT=/some/path/logs/catalina.out rm -f $CATALINA_OUT mkfifo $CATALINA_OUT ( logger -p local0.info -t catalina-out < $CATALINA_OUT & ) Or If the application may issue a close(), the technique below works. APPLOG=/some/path/logs/application.log rm -f $APPLOG mkfifo $APPLOG ( tail -F $APPLOG 2>/dev/null | logger -p local0.info -t application & ) (At least) a couple of drawbacks. 1) the first technique will STALL the application if it tries to write to the named pipe without the logger running. 2) tomcat will sometimes fail to start (it hangs). 3) some extra processes for each app (possibly one or two for each separate log). 4) the 2nd technique can leave these tail -F processes hanging around. They won't exit when the app terminates (like the first technique). You should have your start/stop script kill off these extra processes. 5) logger has a 1K limit for each line. That may be a problem. However, stack traces no longer get lost. Logger will prefix each line of the stack trace with the "program tag ( the -t option to logger). Alan Edmonds -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of Esmq Sent: 23 August 2013 07:15 To: rsyslog-users Subject: Re: [rsyslog] problem about read from named_pipe hi, david just because my program don't support syslog ~ At 2013-08-23 05:03:24,"David Lang" <[email protected]> wrote: >On Thu, 22 Aug 2013, Esmq wrote: > >> hi,list >> >> >> i have a program writes logs to a named_pipe, while rsyslog reads the pipe >> and forward it to remote server. >> >> >> as we known, named_piped has a limted size around 64KBytes, >> >> >> when the program write the logs too excessively, the pipe will be fulled >> even i configure rsyslog to poll every second(PollInterval 1). >> >> >> so i come up with following three solutions: >> >> >> 1) increase the named_pipe size ( only availabe to newer linux kernel and >> have to modify the program to tune the pipe size before writing log to it) >> >> >> 2) configure the program to split the logs, writing to multiple named_pipes, >> then rsyslog reads multiple named_pipes...(is that reasonable?) >> >> >> 3) set rsyslog PollInterval to 0 (performance hit ?!) >> >> >> now i just try the third solution(it seems works) , any body have suggestion >> ? > >Using a named pipe, I think #1 is your best choice, followed by #3. I think >that >#2 would cause no end of problems. > >Is there a reason that you need to use a named pipe instead of writing to a >unix >socket like /dev/log? Yes, it means your logs need to be formatted properly, >but >if you can do that you gain a LOT. > >David Lang >_______________________________________________ >rsyslog mailing list >http://lists.adiscon.net/mailman/listinfo/rsyslog >http://www.rsyslog.com/professional-services/ >What's up with rsyslog? Follow https://twitter.com/rgerhards >NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of >sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE >THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
