Re: [logs] Update/copy logs to logserver (not via syslog)

From: Marcus J. Ranum (mjrat_private)
Date: Mon Feb 18 2002 - 13:46:43 PST

  • Next message: Tycho Fruru: "Re: [logs] Update/copy logs to logserver (not via syslog)"

    It seems to me that a decent enough approach would be to implement
    a remote file by just having a process nail a fifo and let that appear to
    be the output file. Then never bother log-rotating again; just let the process
    transmit the data to a remote machine as fast as it comes in (encryption
    optional...) and let the remote machine do log rolling, etc. We're not
    talking a lot of complex code to implement such a thing...  There's a few
    details, such as having it spool to local disk when connections to the
    remote drop, but that's a trivial implementation problem.
    
    mjr.
    ---
    Marcus J. Ranum          Chief Technology Officer, NFR Security, Inc.
    Work:                           http://www.nfr.com
    Personal:                      http://www.ranum.com
    
    
    ---------------------------------------------------------------------
    To unsubscribe, e-mail: loganalysis-unsubscribeat_private
    For additional commands, e-mail: loganalysis-helpat_private
    



    This archive was generated by hypermail 2b30 : Mon Feb 18 2002 - 13:46:27 PST