This is beyond rsyslog scope. It's simply how linux logging is designed. But you may be interested in liblogging:
https://github.com/rsyslog/liblogging It provides a native file driver, but can also be user-configured to use standard logging. .. Hth Rainer Sent from phone, thus brief. Am 12.07.2014 11:32 schrieb "Justin Lee" <[email protected]>: > Hello List, > > I noticed that local messages are passed by socket rather than > directly written to log files. The evidence is as follows: > > I wrote a small log test in C and sent some message by functions > openlog(), syslog() and closelog(), according to man page SYSLOG(3), > in the test: > > /**** File: slog.c ****/ > #include <syslog.h> > #include <string.h> > #include <stdlib.h> > #include <stdio.h> > > int main(int argc, char * * argv) > { > char buf[1024]; > strncpy(buf, argv[0], sizeof(buf) - 1); > printf("buf: %s\n", buf); > > openlog(buf, LOG_NDELAY | LOG_PID, LOG_USER); > > void * pv = malloc(sizeof(int)); // just get a pointer to be printed > in the message > printf("pv: %p\n", pv); > > syslog(LOG_DEBUG, "The allocated space is at %p\n", pv); > > free(pv); > > closelog(); > > return 0; > } > > And then use strace to peek at the internal system calls in the test > program, I got this: > > . . . > socket(PF_LOCAL, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 3 > connect(3, {sa_family=AF_LOCAL, sun_path="/dev/log"}, 110) = 0 > . . . > send(3, "<15>Jul 12 17:16:40 ./slog[20592]: The allocated space is at > 0x9"..., 71, MSG_NOSIGNAL) = 71 > close(3) = 0 > . . . > > Since log mechanism is an important infrastructure of many programs, > it is supposed to be as fast as possible. So do we have some > configurations or settings in rsyslog which make local messages > written directly into log files without passing through socket? > > Justin Lee > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
