Hello List,
I noticed that local messages are passed by socket rather than
directly written to log files. The evidence is as follows:
I wrote a small log test in C and sent some message by functions
openlog(), syslog() and closelog(), according to man page SYSLOG(3),
in the test:
/**** File: slog.c ****/
#include <syslog.h>
#include <string.h>
#include <stdlib.h>
#include <stdio.h>
int main(int argc, char * * argv)
{
char buf[1024];
strncpy(buf, argv[0], sizeof(buf) - 1);
printf("buf: %s\n", buf);
openlog(buf, LOG_NDELAY | LOG_PID, LOG_USER);
void * pv = malloc(sizeof(int)); // just get a pointer to be printed
in the message
printf("pv: %p\n", pv);
syslog(LOG_DEBUG, "The allocated space is at %p\n", pv);
free(pv);
closelog();
return 0;
}
And then use strace to peek at the internal system calls in the test
program, I got this:
. . .
socket(PF_LOCAL, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 3
connect(3, {sa_family=AF_LOCAL, sun_path="/dev/log"}, 110) = 0
. . .
send(3, "<15>Jul 12 17:16:40 ./slog[20592]: The allocated space is at
0x9"..., 71, MSG_NOSIGNAL) = 71
close(3) = 0
. . .
Since log mechanism is an important infrastructure of many programs,
it is supposed to be as fast as possible. So do we have some
configurations or settings in rsyslog which make local messages
written directly into log files without passing through socket?
Justin Lee
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
