2018-08-22 18:47:00 +02:00
|
|
|
A syslog daemon implementing circular buffer, in-memory storage.
|
|
|
|
|
|
|
|
|
|
This is useful when you want to keep some (heavy detailed) log available, but you don't want to log too many
|
|
|
|
|
things to disk.
|
|
|
|
|
|
|
|
|
|
On your "main" syslog, send some message to this one!
|
2018-08-23 13:00:24 +02:00
|
|
|
|
|
|
|
|
## Integration examples
|
|
|
|
|
|
|
|
|
|
In these examples I'll refer to the usage of UNIX sockets. They are more secure than TCP/UDP sockets because
|
|
|
|
|
they have file permissions, they can be "masked" using mount namespaces, etc.
|
|
|
|
|
However, circlogd supports udp/tcp sockets easily, so that should not be an issue.
|
|
|
|
|
|
|
|
|
|
### syslog-ng
|
|
|
|
|
|
|
|
|
|
To integrate into syslog-ng, put this in `/etc/syslog-ng/conf.d/circolog.conf`
|
|
|
|
|
```
|
|
|
|
|
destination d_circolog {
|
|
|
|
|
unix-dgram("/run/circolog-syslog.sock"
|
|
|
|
|
flags(syslog-protocol)
|
|
|
|
|
);
|
|
|
|
|
};
|
|
|
|
|
log { source(s_src); destination(d_circolog); };
|
|
|
|
|
```
|
|
|
|
|
and run `circologd -syslogd-socket /run/circolog-syslog.sock -query-socket /run/circolog-query.sock`
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
## Client
|
|
|
|
|
|
|
|
|
|
`curl` might be enough of a client for most uses.
|
|
|
|
|
|
|
|
|
|
curl --unix-socket /run/circolog-query.sock localhost/
|
|
|
|
|
|
|
|
|
|
will give you everything that circologd has in memory
|
|
|
|
|
|
|
|
|
|
If you want to "follow" (as in `tail -f`) you need to use the websocket interface. However, I don't know of
|
|
|
|
|
any websocket client supporting UNIX domain socket, so you have two options:
|
|
|
|
|
|
|
|
|
|
1. wait until I write a proper `circolog-tail` client implementing it all
|
|
|
|
|
2. Use `circologd` with `-query-addr 127.0.0.1:9080`, add some iptables rule to prevent non-root to access that
|
|
|
|
|
port, and run `ws ws://localhost:9080/ws`. You'll get all the "backlog", and will follow new log messages.
|
