[H-GEN] Logging over serial ports

[Bruce Campbell]

(Note reply-to: being general at humbug.org.au vs Bruce Campbell <bc at thehub.com.au>)

On Fri, 9 Apr 1999, David Jericho wrote:

> On Fri, Apr 09, 1999 at 03:38:40PM +1000, David Jericho wrote:
> > I want to log the goings on of my two firewalls over a serial port
> > to a dedicated machine, which then turns all the info into really
> > pretty html for my boss. 
> 
> I want _ALL_ logged information to be dumped over the serial ports
> to the logging box. As in EVERYTHING.
> 
> That means squid access logs, {tcp,udp,icmp}log files, syslog, apache
> logs, mailer logs. 
> 
> As far as I've been able to manage, I can't get squid to dump its access_log
> to syslog. Nor apache's logs to syslog. Starting to see my problem now?

Use the 'logger' program to dump the apache and squid logs to syslog (and
thus down the serial port).  You will need to do some massaging of the
data of the other end to de-syslog apache and squid logs (so you can run
the apache/squid log analysis programs on it).

Good Things:

As only one process is using the serial port, you shouldn't lose data that
way.  (see caveats)

Caveats:

In a high-traffic situation, syslogd may drop entries.  However, if you
are in such a situation, you probably have more serious problems.  

'logger' is inefficient, although as the source code is available, you
should be able to write a custom 'dump file to syslog' program.

You have no check coming back to make sure that the data was received
successfully, beyond that provided by the serial port.  This is no
different from standard UDP syslogd logging to another host.

--==--
Bruce.


--
This is list (humbug) general handled by majordomo at lists.humbug.org.au .
Postings only from subscribed addresses of lists general or general-post.