in reply to Reading log files that get overwritten

I just had a perl epiphany!
Be aggressive! Do this:

Assuming that the data to be written will buffer and then
be written to the file in a large chunk --> lock the file so that the FWall cant write to it.

o Wipe the file clean
o Release the lock
o Lock again
o Read file's contents (which have been written when you released the lock )
o Send the contents to syslog
o Wipe file clean
o Unlock again and repeat the whole operation

I think this should work very well.
-bl0rf

  • Comment on Re: Reading log files that get overwritten

Replies are listed 'Best First'.
Re: Re: Reading log files that get overwritten
by waswas-fng (Curate) on Jan 03, 2003 at 00:56 UTC
    Bad, FW1's log write queue has a finite length and blocking it may lead to blocking on the packet inspector on a busy firewall.

    -Waswas
      Waswas is right ... The point of this exercise is to have a secondary source for log data incase the management server where to fail.

      Dave -- Saving the world one node at a time