9

In FreeBSD there are an utility to support circular log files called clog.

This is very interesting for avoid the maintenance of the logs of some services (outside systemd and their journald).

Are there any alternative to do the same in linux and/or with rsyslog?

rfmoz
  • 804

1 Answers1

9

There are tools to do much the same in both FreeBSD and Linux, and other operating systems besides.

Making automatically-rotated strictly size-capped logs

The following tools maintain strictly size-capped, automatically rotated, rotateable-on-demand, log file sets in a directory that one specifies.

Usage is very simple: Send a to-be-logged process's standard output and standard error through a pipe to their standard input, in the normal way:

./thing-to-be-logged 2>&1 | cyclog logs/

cyclog adds TAI64N timestamps to lines as standard. For timestamp-free processing when something is already timestamped, use one of the multilogs, s6-log, or svlogd, in each of which timestamp addition is a non-default option.

Substituting for syslog

What you point to modifies FreeBSD syslog itself, with a patch dating from 2001 that may not apply cleanly nowadays, to have another output file mechanism.

An alternative approach is to simply replace the syslog dæmon completely, alongside configuring more services to simply log to standard error (under service management that pipes standard error to logging services) instead of using syslog in the first place.

For example: The nosh toolset provides several such substitutes, that split up the job of syslog and generate output suitable for feeding through the standard input of one of the aforementioned logging tools:

  • a klogd service that runs a simple program named klog-read to read from /proc/kmsg and simply write that log stream to its standard error.
  • a local-syslog-read service that runs a program named syslog-read to read datagrams from /dev/log (/run/log on the BSDs) and simply write that log stream to its standard error.
  • a udp-syslog-read service that runs the aforementioned syslog-read program to listen on the UDP syslog port and simply write that log stream to its standard error.
  • a local-priv-syslog-read service that runs the aforementioned syslog-read program to read datagrams from /run/logpriv and simply write that log stream to its standard error.

Further reading

JdeBP
  • 68,745