Hello,

Using Linux syslog, I have the possibility to write the output to a pipe.
I then can read this pipe from a program.

My question is, what happens when there is no one reading from the pipe.
Informal testing shows that when I write to the pipe myself, it stalls
until the pipe is read. Yet syslog seems to be chucking along. Does it set
some flags on the pipe? Does it increase the buffer?

The main point is, even though it seems to work, syslogging to
files/remote servers continues even when the pipe is not read, would it
stall syslogging in the longer run? So how safe is it to use this feature?

TIA,
M4
--
Redundancy is a great way to introduce more single points of failure.

[ Post a follow-up to this message ]

Martijn Lievaart <m@remove.this.part.rtij.nl> writes:
> Using Linux syslog, I have the possibility to write the output to a pipe.
> I then can read this pipe from a program.
>
> My question is, what happens when there is no one reading from the pipe.
> Informal testing shows that when I write to the pipe myself, it stalls
> until the pipe is read. Yet syslog seems to be chucking along. Does it set
> some flags on the pipe? Does it increase the buffer?

(At least in Debian) the Linux syslogd sets O_NONBLOCK on named pipes
and ignores both EAGAIN and short writes.

> The main point is, even though it seems to work, syslogging to
> files/remote servers continues even when the pipe is not read, would
> it stall syslogging in the longer run? So how safe is it to use this
> feature?

syslogd should not wedge but you will have missing and/or mangled
messages if they arrive faster than you can process them.

I don't think this is a very reliable way of reading syslog messages
unless you have a guarantee the rate will be low enough; tailing a
disk file would be safer.

--
http://www.greenend.org.uk/rjk/

[ Post a follow-up to this message ]

On Sat, 05 Mar 2005 14:07:12 +0000, Richard Kettlewell wrote:

[ Syslog and pipes ]

> I don't think this is a very reliable way of reading syslog messages
> unless you have a guarantee the rate will be low enough; tailing a
> disk file would be safer.

Ah but that has it own set of problems. How do you manage the messages
that arrive between restarts of your log-processing deamon? However, given
your description of syslog and pipes, using pipes does not solve those
problems at all, on the contrary.

Back to the drawing board. Remembering the position and the inode between
runs should be safe for syslog files, Just have to make sure logrotation
is handled correctly. Accepting dropped messages when the deamon is not
running when a logrotate occurs makes this manageable I think.

Thx,
M4


--
Redundancy is a great way to introduce more single points of failure.

[ Post a follow-up to this message ]

Martijn Lievaart <m@remove.this.part.rtij.nl> writes:
> Richard Kettlewell wrote:
 
>
> Ah but that has it own set of problems. How do you manage the
> messages that arrive between restarts of your log-processing deamon?
> However, given your description of syslog and pipes, using pipes
> does not solve those problems at all, on the contrary.
>
> Back to the drawing board. Remembering the position and the inode
> between runs should be safe for syslog files, Just have to make sure
> logrotation is handled correctly. Accepting dropped messages when
> the deamon is not running when a logrotate occurs makes this
> manageable I think.

I would invoke GNU tail and use the --follow=name option.

--
http://www.greenend.org.uk/rjk/

[ Post a follow-up to this message ]

On Sun, 06 Mar 2005 09:08:41 +0000, Richard Kettlewell wrote:
 
>
> I would invoke GNU tail and use the --follow=name option.

That's not very reliable too in case of a restart. You'll never be able to
figure out where you left off.

M4
--
Redundancy is a great way to introduce more single points of failure.

[ Post a follow-up to this message ]

Martijn Lievaart <m@remove.this.part.rtij.nl> writes:
> Richard Kettlewell wrote:
 
>
> That's not very reliable too in case of a restart. You'll never be
> able to figure out where you left off.

That's a good point.

--
http://www.greenend.org.uk/rjk/

[ Post a follow-up to this message ]